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In the last two decades the digitization of our lives has accelerated at a sometimes 
breathtaking rate. It is appearing in ever more aspects of our existence to the point 
of becoming all-encompassing. Ever larger amounts of data are generated, stored, 
processed and transmitted. This is driven by increases in processing speed and 
computational performance. The latter is achieved by ever greater miniaturization 
of circuits and physical memory requirements. As this trend continues rather sooner 
than later atomic or even sub-atomic scales will be reached. At the latest at that 
point the laws of quantum mechanics will be required to describe the computational 
process along with the handling of memory. 

Originating from this anticipation as well as from scientific curiosity, many 
researchers over the last quarter century have thus investigated how information can 
be stored and processed in systems described by quantum mechanical laws. In 
doing so they created the science of quantum computing. 

Quantum computing is unique in the sense that nowhere else are fundamental 
questions in physics so closely connected to potentially huge practical implications 
and benefits. Our very basic understanding of what constitutes reality is challenged 
by the effects which at the same time seem to enable enormous efficiency gains and 
to revolutionize computational power and cryptographic protocols. 

What is also quite enticing is that quantum computing draws from many 'dis- 
tinct' branches of mathematics such as, of course, analysis and linear algebra, but to 
an even greater extent functional analysis, group theory, number theory, probability 
theory and not least computer science. 

This book aims to give an introduction to the mathematics of this wide-ranging 
and promising field. The reason that despite being an introduction it is so volu- 
minous is that the reader is taken by the hand and led through all arguments step by 
step. All results are proven in the text in—for the cognoscenti perhaps excruciating 
—detail. Numerous exercises with their solutions provided allow the reader to test 
and develop their understanding. Any requisites from branches, such as number 
theory or group theory, are provided with all stated results proven in the book as 
well. 


vii 
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For the above reasons this book is eminently suitable for self-study of the 
subject. The attentive and diligent reader does not have to consult other resources to 
follow the arguments. The level of mathematical know-how required approximately 
corresponds to second year undergraduate knowledge in mathematics or physics. 

It is very much a text in mathematical style in that we follow the pattern of 
motivating text—definition—lemma/theorem/corollary—proof—explanatory text 
and all over again. In doing so all relevant assumptions are clearly stated. At the 
same time, it provides ample opportunities for the reader to become familiar with 
standard techniques in quantum computing as well as in the related mathematical 
sub-fields. Having mastered this book the reader will be equipped to digest sci- 
entific papers on quantum computing. 

I enjoyed writing this book. I very much hope it is equally enjoyable to read it. 
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stands for the Abelian Hidden Subgroup Problem, which is the problem 
to identify a subgroup from a function on the group that leaves the 
subgroup invariant 

stands for adiabatic quantum computing 

stands for a quantum mechanical cryptographic key distribution method 
proposed in 1984 by BENNETT and Bnassanp in [1] 
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stands for CLAUSER-HorNE-SHIMONY-HOLT, four authors of а general- 
ization of the BELL inequality given in their joint article [2] 
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discrete logarithm d in the context of a group when only given the group 
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stands for Digital Signature Algorithm, which is any cryptographic 
protocol that allows to add a digital signature to a digital document so 
that the signature can be easily verified by anyone but is (almost) 
impossible to forge 

stands for Elliptic Curve Digital Signature Algorithm, which is a DSA 
based on elliptic curves. It is used by bitcoins 

stands for a cryptographic key distribution protocol proposed in 1991 
by Exert [3], which uses the снѕн version of the BELL inequality to 
detect eavesdropping 

stands for EINSTEIN-PopoLsky-RosEn, three authors of a paper [4] in 
1935 in which the counter-intuitive effects of quantum mechanics are 
used to argue for its incompleteness 

stands for Hidden Subgroup Problem 

is an abbreviation for orthonormal basis, the maximal set of linearly 
independent and pairwise orthogonal unit vectors in a linear space with 
a scalar product 
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Glossary 


stands for quantum error correcting code 

stands for Quadratic Unconstrained Binary Optimization 

denotes the ‘classical’ public key cryptographic method developed by 
Rivest, SHAMIR, and ADLEMAN in 1978 


Symbols 


Defining equality, that is, the expression a :— b defines a by b 
Set of natural numbers, that is, N :— {1,2,3,...} 

Set of natural numbers including zero 

Set of prime numbers, that is, Pri := {2,3,5,7,11,...} CN 
Set of integers, that is, Z :— (0, +1, 
Field of binary numbers (0, 1) with Tem addition and 
standard multiplication 

Field of rational numbers л with q € Z and p E N 


Field of real numbers; R denotes the positive real numbers 
Imaginary unit, that is, 17 = —1 

Field of complex numbers a +ib with a,b € R and i? = —1 
Complex conjugate of z = a +ib with a,b € R, that is, 
Z=a-—ib 

Absolute value of the complex number z = a+ ib with 

a,b € R, that is, |z| = VZ = va? +b? 

Image f{S} C Y of the subset S C X of a mapping f : X —^ Y 
Vector in IR", C" or F} 

Scalar product of the vectors a and b in C"; for a, b € IR" this 
equals a-b 

Norm of the vector a € C”, that is, |a| := va. a 

Linear combination of PAULI matrices Су = бу, G2 = Oy, 


оз = о; with coefficients a € R? , that is, а. © := xx 


1 95) 
Alternative notation for the PAULI matrices, that is, 

1—009, Х= о = о, Y—0,—05 Z—0:—03 
often used in the context of quantum gates 
HiLBERT space, that is, a complex vector space with a scalar 
product which induces a norm 
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Symbols 


Linear ‘span’ of a set of vectors (vi,..., Vn} of a linear 
space V over a field F, that is, the subspace of V created 


by all vectors of the form v — У) аууу, where 
j=l 


falje {1,....n}} CF 

Qubit Hir.BERT space, that is, ће HILBERT space Н = С? 

‘Ket’ notation for a vector in a HILBERT space 

*Bra' notation for a vector in the dual space to a HILBERT space 
Scalar product of the vectors |o), |) € H 

Norm of the vector |) € H, that is, ||| := v (|) 
KRONECKER delta 


E l, ifx=y 
"7" |0, else. 


To avoid confusion we sometimes insert a comma 

and write, for example, Ônp mq instead of дт 

Identity operator іп Н, or identity matrix іп R”, C", F}, that is, 
1|y) = |W) for all |) € H. To make things more explicit we 

may also write 1^ for the identity operator in H^ to distinguish 
it from an identity operator 1^ in a different Нивевт space H^. 
Likewise, we also write 1°” for the identity operator in 

H- H8” 

Set of linear operators on H, that is, 


L(H) := {A : H — H |A linear } 
Set of bounded linear operators on H, that is, 
B(H) := {A € L(H)| ||A|| <20} 


Transpose of matrix A, that is, A; = Aji 

Adjoint operator (or matrix) of A, that is, (o|Ay) = (A*@|W) 
for all |), |W) € H 

Trace of operator A € L(IH) or matrix A € L(C"), that is, 
(А) := 5 /Ajj, where Aj are the matrix elements in some ONB 
The partial trace over Н? for an operator M € L(H^ & H? ) 
Spectrum of A € L(H), that is, the set 


o(A) := (4 € C|(A — 21)" does not exist] 


The linear subspace spanned by all eigenvectors of the operator 
A : H — H with eigenvalue 4, that is, 


Eig(A, 4) := Span(|) € НАМИ) = А10) } 


Symbols 


[А,В] 
P{Event} 
le) ® |W) 
H8” 

Sy 

By 


|x) 


amodn 


Xn—-1---X02 


хуп 

Set of bounded self-adjoint operators on a HILBERT space H, that 
is, 

В..(Н) := (A € B(H)|A* = A} 
Group of unitary operators on a HILBERT space H, that is, 

W(H) := (A € B(H)|A*A = 1] 
Convex set of density operators on a HILBERT space H, that is, 

D(H) := (p € L(H)|p* = p, p 20, tr(p) = 1} 


Set of self-adjoint positive operators on a HILBERT space H with 
trace less than 1, that is, 


D«(H) := (p € L(H)|p* = p,p 20, (р) < 1} 


Commutator of the operators A and B, that is, [А, B] := AB — BA 
Probability of ‘Event’ happening 

Tensor product of two vectors |o), |) € H 

n-fold tensor product of ће qubit HILBERT space “H 

The sphere of radius r in the normed vector space V, that is, the 
set of vectors v € V with ||v|| =r 

The full ball of radius r in the normed vector space V, that is, 
the set of vectors v € V with ||v|| <r 

Vector of the computational basis in "IH?" given for each x € No 


with x — DT xj2/ < 2" and x; € {0, 1} as 


0 
Bp @ Ix) =) Ф... Әә) = [cis 0) 


Negation of proposition A 
Integer part of a real number a € R, that is, 


|a| := max{z € Z|z <a} 
Nearest integer from above a real number a € R, that is, 
[a] := min{z € Z| z> a} 
Remainder of a after division by n, that is, 
amodn := a — [|n 


Binary representation of a number x € No satisfying x < 2", 
that is, 


п—1 А 
ара Lad with x; € {0,1} 
j-0 
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Or Qn» 


ordy(b) 


Symbols 


2 
Binary addition a@ b := (a+b) mod 2 
Binary scalar product defined as 


2 2 2 n-l 
XOy:— Xii Yn-1 ©...© луу = | У) xy; | mod2 
j=0 


for vectors |x), |y) ЄЇН®” in the computational basis or vectors 
х,ує Е 

Factor-wise binary addition for vectors |х), |y) ЄЗЇН?” in the 
computational basis; this addition is defined by 


0 2 
IxB y) := C9 gy) 
j-n-1 


a divides b, that is, there exists a z € Z such that b = az 
a does not divide b, that is, all z € Z satisfy b Z za 


Greatest common divisor of a; € Z,i € {1,...,n} with 
У) la;| z 0, that is, 
gcd(aj,...,a,) := max{k € N|Va; : kla;}. 


Note that for a Z 0 one has gcd(0, a) = |a| 
Smallest common multiple of a;,...,a, € Z with [[7 , a; 4 0, 
that is, 


sem(a,, ...,a,) := min(k € N| Va; : aj|k) 


Set of prime factors in the prime factorization of n 
Prime factorization of n € N, where the exponents of the primes 
p € Pri, which do not occur as a prime factor of n, are zero, that 
is, vp = 0 if p ¢ Pri(n). For a € Z \ {0} we define the prime 

Р š 007 lal, 
factorization of |a| € N and set a = sign(a) | [,-pi(4) P 
EurER function 

o:N-N 

ni b(n) := |{r € 0... — 1 ged(n, r) = 1} 
The order of b modulo N defined for natural numbers b and N 
with the property gcd(b, N) = 1 as 
ordy(b) := min(n € N| b” mod N = 1} 

Identity map on the set A, that is, id, : A — A with id4 (a) = a 


Small Lanpau symbol, defined here for functions on N in the 
limit n — oo as 


f(n) € o (g(n)) for (n = оо) 
е VeE€Ri,IMEN: Vn M :Jf(n)| x e| g(n)| 


Symbols 


Big Lanpau symbol, defined here for functions on N in the limit 
n — œ as 
f(n) € O (g(n)) for (n — оо) 
: 3€ € R, M € NYn > M :|f(n)| € € | g(n)] 


Exponential function applied to A, that is, 

e^ = exp(A) := У) 41у, where A can be complex number, а 
matrix or an operator 

Denotes the number of the elements of the set S 

Denotes the order of a finite group 9, that is, the number of its 
elements 

For groups H and S the expression H < S states that H is a 
subgroup of the group б 

For groups H and 9 the expression J( « 9 states that H is a 
proper subgroup of the group б 

For groups H and 9 the expression H<9 states that H is a 
normal subgroup of the group б 

States that group H is isomorphic to group 9, that is, there 
exists a bijective map between them which respects the group 
operations; for linear spaces the group operation is addition 
The Раши group given by 


P := (i^o;|a,x € {0,...,3}} < UCH) 
The n-fold Pauti group given by 
Ф, := (i^o, , @...@ 04 € LCH?")la, o; € {0,...,3}} 
< AIT) 


Chapter 1 A) 
Introduction шс 


1.4 Some History 


The origin of the prefix ‘quantum’ goes back to the start of the 20th century, when 
PLANCK in the derivation of the black-body radiation law postulated the existence 
of a minimal *quantum' of energy [5]. A few years later EINSTEIN also used this 
assumption in the theory of the photo-electric effect [6]. Despite these early origins 
the story of quantum mechanics only came to the fore almost twenty years later 
in the ‘golden twenties’ with the works of BOHR, SCHRODINGER, HEISENBERG, 
PAULI, BORN and many others. 

Quantum mechanics describes so-called microscopic systems by means of a 
mathematical formalism that in general allows only statements about probabilities. 
What can be known about a system, that is, its state, is described mathematically 
by a vector in a linear space. This makes it possible that a system can be in a state 
which is a linear combination of other states. Moreover, the mathematical theory 
of quantum mechanics also provides a statement about which physical quantities 
of a system—its so-called observables—can in principle be determined at the same 
time and with which maximally possible precision. The HEISENBERG uncertainty 
principle is perhaps the most well known notion in this context. 

Starting from a few basic assumptions, the so-called Postulates of quantum 
mechanics, the theory allows the derivation of many results and statements. Some of 
these can be difficult to reconcile with our intuition and have become known as para- 
doxes. Prominent examples hereof are the EINSTEIN-PODOLSK Y-ROSEN(EPR)- 
Paradox [4] and the often quoted SCHRODINGER’s cat, which SCHRODINGER pre- 
sented to the world in a review paper [7]. In this article SCHRODINGER also coins 
the term entanglement, which describes a quantum mechanical phenomenon that 
challenges our intuition about what constitutes reality yet at the same time plays an 
essential role in quantum computing. 

Entanglement is also crucial in the context of an inequality for correlations 
derived by BELL in the sixties under the assumption of the existence of so-called 
hidden variables [8]. Roughly speaking the BELL inequality makes assumptions 
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that are very much in line with our intuition of what one might call the physical 
reality of a system. At the same time, however, quantum mechanics predicts that 
this inequality is violated in certain entangled states. In 1969 a generalization of the 
BELL inequality was derived by CLAUSER et al. [2]. This version was then indeed 
shown to be violated in an experiment conducted by ASPECT et al. [9]. In other 
words, rather than following our intuition about reality, nature follows the “counter- 
intuitive' predictions of quantum mechanics. 

As with the predictions for the BELL inequality quantum mechanics has so far 
passed all other all other experimental tests. Beyond that it has lead to numerous 
applications like lasers, transistors, nuclear energy, nuclear resonance tomography 
and many more, which have fundamentally changed the world and will continue 
to do so. Insofar it is probably no exaggeration to name quantum mechanics as the 
most successful scientific theory ever. 

The history of information theory has its beginning around the forties of the past 
century with WIENER [10] and SHANNON [11]. Classical information is stored and 
processed in the form of clearly distinguishable binary states. The success of con- 
ventional computer science and digitization relies on the fact that any superposition 
of these binary states is excluded and the system is always in a clearly definable 
state. As we shall see in due course, this is in stark contrast to what can be said 
about entangled states utilized in quantum computation. 

A first mentioning of the possibly enhanced capabilities of a quantum computer 
compared to the classical computational process is attributed to FEYNMAN [12]. 
Motivated by the difficulty of classical computers to simulate quantum systems effi- 
ciently, he wondered in the early eighties if a computer whose computational opera- 
tions utilized quantum effects would outperform a classical processor. In doing so he 
noted that a ‘quantum mechanical computer’ can indeed simulate quantum systems 
more efficiently than a classical computer. 

An analysis looking at the combination of quantum mechanics with the theory of 
computational processes à la TURING [13] by BENIOFF [14] appeared simultane- 
ously with FEYNMAN’s paper. Also in 1982 appeared the often quoted Quantum No- 
Cloning Theorem by WOOTTERS and ZUREK, stating the impossibility to copy an 
unknown quantum system [15]. The combination of quantum mechanics with infor- 
mation theory then picked up speed in the eighties with contributions by DEUTSCH, 
who formalized quantum mechanical computational processes and circuits [16, 17]. 

This was motivated by the hitherto often ignored fact that information has a 
physical origin. Consequently, (at first hypothetical) questions were asked, such as: 
which physical options exist for the storage and processing of information by quan- 
tum mechanical systems? Will this lead to knew information theoretic phenomena? 
Are there efficiency gains? 

The rapidly progressing miniaturization of computational storage devices increas- 
ingly brought these questions out of the hypothetical realm into the focus of a practi- 
cal interest. This ever more so because the deliberate control of microscopic systems 
had advanced considerably in the last decades. By now the class of such microscopic 
systems encompasses atoms, electrons and photons, which nowadays can be manip- 
ulated quite extensively in the laboratory. 
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The basic tenet of the combination of information and quantum theory is the 
usage of quantum mechanical states for the storage and processing of information 
obeying the laws of quantum mechanics. Contrary to the classical binary represen- 
tation of information, where this is to be avoided, the possibility of a superposition 
of several states and the probabilistic nature of quantum mechanics allows for the 
emergence of new and interesting possibilities. 

One such possibility was added in the nineties with the curious teleportation of 
quantum states by BENNETT et al. [18]. This was followed by SHOR with his factor- 
ization algorithm [19, 20] and GROVER with his search algorithm [21, 22], which 
both demonstrated for the first time the potential supremacy of quantum computers 
in solving real world problems. These three methods lead to a substantial increase in 
the interest in quantum computers. Soon they were experimentally realized, albeit 
more as proofs of concept. First in 1997 the teleportation by BOUWMESTER et 
al. [23]; thereafter in 1998 the search algorithm by CHUANG et al. [24] and in 2001 
the factorization of 15 by L. M. VANDERSYPEN et al. [25]. 

The factorization and search algorithm require functioning quantum computers, 
if they were to work on large inputs, and so far have only been demonstrated in 
minimal circumstances in the laboratory. In contrast, teleportation has been achieved 
over ever larger distances such as 143 km [26] or even up to a satellite orbiting the 
earth [27]. 

The nineties also saw important contributions to the computational process such 
as methods for error correction. Given the difficulty to shield quantum systems from 
unwanted interactions the ability to correct errors becomes crucial. This task is made 
more difficult in a quantum computer due to the fact that a measurement can impact 
the state of the system. Nonetheless methods to deal with these problems were pro- 
posed by CALDERBANK and SHOR [28] as well as by STEANE [29]. Moreover, the 
properties of quantum gates, in particular universality, were proven by BARENCO 
et al. [30] and DIVINCENZO [31]. 

Simultaneous to the progress around the computational process, gates and algo- 
rithms new protocols were developed for the public exchange of cryptographic 
keys based on quantum mechanical properties that allowed eavesdropping detec- 
tion. These protocols do not require the existence of a quantum computer and can 
thus already be realized with existing hardware. The first of these protocols utiliz- 
ing quantum properties was presented in 1984 by BENNETT and BRASSARD [1]. 
Whereas their protocol does use quantum mechanical properties to detect eaves- 
dropping, it does so without recourse to entanglement. A different protocol making 
explicit use of entanglement properties was proposed at the beginning of the nineties 
by EKERT [3]. 

Another way to harness the computational power of quantum mechanics emerged 
with what has become known as adiabatic quantum computing. Rather than using 
quantum analogs of classical gates, this method exploits the results around the Quan- 
tum Adiabatic Theorem. Here the solution to a problem is encoded in an eigenstate 
(typically the ground state) of a Hamiltonian that is reached by a suitably slow adi- 
abatic evolution from a known initial state. This idea had its precursor in what was 
called quantum stochastic optimization and quantum annealing introduced in 1989 
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by APOLLONI et al. [32]. The groundwork for what we now call adiabatic quan- 
tum computing was laid by VAN DAM et al. [33] in 2001 and in 2008 AHARONOV 
et al. [34] showed the efficiency equivalence between the adiabatic and gate based 
quantum computation. 

In the first decade of the present millennium the theory of a topological quantum 
computer began to be developed. Influenced by the works of FREEDMAN et al. [35] 
and KITAEV [36] this paradigm of quantum computing makes use of the topolog- 
ical properties of quantum systems in two spatial dimensions. This potential path 
towards a quantum computer would have the benefit of offering greater stability and 
protection against undue interactions with the environment and thus requiring less 
error correction. 

It seems that the last chapter of quantum computing has not been written yet and 
this book is also meant as an invitation to perhaps contribute a few lines to that story. 


1.2 Reader's Manual 


In this book we present the elementary mathematical aspects of quantum computing. 
Itis self-contained in the sense that with only two minor exceptions all stated results 
are also proven in the book. To master its content it is not necessary to consult other 
references, making it suitable for autonomous self-study. 

The level of presentation is such that students of physics, mathematics or com- 
puter science with knowledge of advanced undergraduate mathematics or anyone 
with comparable mathematical knowledge will be able to digest the material after 
which they should be able to read scientific papers on the subject. 

The form of presentation is generally a repetition of sequences of motivating 
or explanatory text followed by definition(s), then results in the form of lemmas, 
propositions or theorems and then their proofs. Often a main result is prepared in 
smaller packages in the form of several preparatory lemmas leading up to a theorem. 
Likewise, several consequences of a main result may be packaged in corollaries. 
Numerous exercises form an essential part of the logic flow. Their solutions are 
provided in appendices, but the reader is well advised to attempt to solve them, as it 
will greatly enhance their understanding of and familiarity with the material. 

The mathematical objects necessary for quantum mechanics such as HILBERT 
spaces, operators, and their properties are presented in Chap.2 together with the 
basic principles (aka ‘Postulates’) of quantum mechanics. The background material 
for some other areas such as results from number theory or group theory has been 
outsourced to several appendices. Otherwise, we adhere to what we call the proof- 
as-you-go approach, in other words, when we need a result in a chain of arguments, 
we will prove it then and there. 

Our approach enables us to state the results and their pre-conditions in a mathe- 
matically rigorous form. However, as to the level of generality and technical detail 
applied—in particular in the context of infinite-dimensional HILBERT spaces— 
some compromises had to be made. The mathematics of quantum computing hardly 
ever needs more than finite-dimensional spaces. Hence, most results are restricted 
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to this case, but almost all hold in the infinite-dimensional case, albeit with much 
more technical proofs. 

In Chap. 2 we begin our exposition with a brief introduction into the mathemat- 
ical formalism of quantum mechanics that equips the reader with the mathematical 
know-how necessary for the understanding! of quantum mechanics. 

Using the previously made available mathematics we then present in Sect. 2.3 
the basic postulates of quantum mechanics and derive some results, such as the 
uncertainty relation. In Sect. 2.3.1 we consider pure states and in Sect. 2.3.2 mixed 
states as well before we introduce qubits in Sect. 2.4. At the end of this chapter 
we present in Sect. 2.5 operators on qubits, which are important in the context of 
quantum gates. 

In Chap.3 we give a description of two or more ‘particles’? with the help of 
tensor products. For this we define tensor products and introduce the useful compu- 
tational basis in Sect. 3.2.1, before we review states and observables for composite 
systems in Sect. 3.3. In doing so we also exhibit a number of identities for partial 
traces that are particularly useful in the context of composite systems. Section 3.4 
contains a presentation of the SCHMIDT decomposition. The chapter concludes with 
a detailed exposition of quantum operations in Sect. 3.5. 

In Chap. 4 we discuss entanglement in some detail. We begin this with a general 
definition in Sect. 4.2 that also holds for mixed states before we present special cri- 
teria for entangled pure states. In the subsequent Sect. 4.3 we show the curious pos- 
sibility of entangling two systems even though they have not interacted. In Sect. 4.4 
the EINSTEIN-PODOLSKI-ROSEN-paradox, (aka EPR-paradox) is discussed exten- 
sively. After that we turn to the BELL inequality in Sect. 4.5, which we first present 
in its original form given by BELL in Sect. 4.5.1. The version derived by CLAUSER, 
HORNE, SHIMONY and HOLT is then presented in Sect. 4.5.2. The sections about 
EPR and the BELL inequality do not contain results that are essential for quan- 
tum computing. Nevertheless, we have included them here, since they illustrate the 
counter-intuitive aspects of entanglement and since the BELL inequality is used to 
detect eavesdropping in a cryptographic protocol, which we present later. At the 
end of this chapter we illustrate two devices that cannot work as intended due to the 
laws of quantum mechanics. One of them is the proposal to use entangled states to 
transmit signals instantaneously, which has become known as BELL’s telephone. In 
Sect. 4.6.1 we show that this does not work. Likewise, we cannot build a device that 
copies arbitrary unknown qubits. This statement, which has become known as the 
Quantum No-Cloning Theorem, will be proven in Sect. 4.6.2. 

In Chap. 5 we turn to quantum gates and circuits. After a short recall of the usual 
classical gates in Sect. 5.1 we consider quantum gates in Sect. 5.2. In Sect. 5.2.3 
we show how arbitrary unitary transformations can be generated with a suitable 
number of elementary gates. Next, we exhibit in Sect. 5.5 how elementary computa- 
tional processes, such as addition, modular exponentiation or the quantum FOURIER 


! Although many, including FEYNMAN, say that no one can ‘understand’ quantum mechanics. 


?]n this book the ‘particle’ stands synonymous for any object which is described by quantum 
mechanics, such as electrons or photons. 


6 1 Introduction 


transform, can be implemented with elementary gates. This chapter stands some- 
what apart in that it is not really necessary for the understanding of the following 
material. In this sense it can be left out without endangering the reader's grasp of 
the other parts of the book. 

In Chap.6 we return to entanglement and look at a few prominent examples 
of how useful it can be. As a uniquely quantum mechanical ingredient it allows 
effects that are impossible to generate with classical bits. We begin this chapter 
in Sect. 6.1 with the DEUTSCH-JOZSA algorithm as an historically early indicator 
of the promise of quantum computing. Next in our list is dense quantum coding, 
which we treat in Sect. 6.2. This is followed by teleportation, which we present in 
Sect. 6.3. After this we turn in Sect. 6.4 to quantum cryptography. Following a brief 
introduction to ciphers in cryptography in Sect. 6.4.1 we introduce two protocols in 
which the laws of quantum mechanics allow the detection of eavesdropping. The 
protocol presented in Sect. 6.4.2, however, does not make use of entanglement and 
requires the transport of particles from sender to receiver. In contrast, the protocol 
presented in Sect. 6.4.3 does utilize entanglement and avoids the exchange of parti- 
cles, if both parties already have a supply of qubits entangled with those of the other 
side. In Sect. 6.4.4 we exhibit the basics of the RSA public key distribution proto- 
col, which is then shown to be vulnerable in a detailed look at SHOR’s factorization 
algorithm in Sect. 6.5. A generalization of this algorithm consisting of finding hid- 
den subgroups of abelian groups is presented in Sect. 6.6. In Sect. 6.7 we show how 
the general hidden subgroup algorithm may be used to find the discrete logarithm 
in abelian groups. This is of particular relevance for cryptographic protocols such 
as the Elliptic Curve Digital Signature Algorithm that rely heavily on finding the 
logarithm being difficult. In Sect. 6.8 we have closer look at this protocol which is 
used for signing bitcoin transactions. The chapter concludes with a detailed look at 
GROVER'S search algorithm in Sect. 6.9. This is not only a prime example of the so 
called amplitude amplification quantum algorithms but also one of the few where 
the underlying problem is easily understood by the uninitiated. 

In Chap. 7 we introduce the basic notions of error correction. We begin this 
by means of an overview of possible error sources for quantum computation in 
Sect. 7.1. In Sect. 7.2 we exhibit the essentials of classical linear error correcting 
codes. This is done with a view towards similar structures in quantum error correct- 
ing codes to which we turn in Sect. 7.3. Quantum codes, error and recovery oper- 
ators are introduced in Sect. 7.3.1 along with theorems providing conditions under 
which a quantum code can detect and correct a given set of errors. In Sect. 7.3.2 
we define error detection by means of syndrome extraction and give an error detec- 
tion and correction protocol. A compact and elegant formulation of quantum error 
correcting codes is presented in Sect. 7.3.3 with the stabilizer formalism. 

In Chap. 8 a detailed exposition of adiabatic quantum computing is given starting 
with a brief introduction in Sect. 8.1. In Sect. 8.2 we state the assumptions underly- 
ing the adiabatic method and derive important results about the quality of the adi- 
abatic approximation, which is at the heart of this method. In doing so, we make 
use of the quantum Adiabatic Theorem for which we give a thorough proof in 
Appendix G. A generic version of the adiabatic method is presented in Sect. 8.3. 
As an application of this we then look in Sect. 8.4 at a search algorithm using the 
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adiabatic method. There we also show that with a suitably adapted algorithm the 
efficiency of the GROVER search algorithm of Sect. 6.9 can be obtained. Since both 
the adiabatic and circuit based method produce the final state, the question arises, 
if one method might be more efficient than the other. In Sects. 8.5 and 8.6 we shall 
show that the two approaches are indeed equivalent in their efficiency. 

At times the auxiliary results we use to prove a statement themselves require 
rather lengthy proofs. Whenever this becomes to voluminous or it seems best to 
gather several of such related results, we have opted to outsource them to appendices 
in order not to interrupt the flow of arguments too much. 

In Appendix А we thus collect a few definitions from probability theory. 

The algorithms presented in Appendix B are formalized binary versions of nor- 
mal addition and subtraction. With their help we can then verify that the quantum 
circuits defined in Sect. 5.5 indeed implement these two elementary operations. 

In Appendix C we briefly give our definitions of the LANDAU symbols. 

АП modular arithmetic necessary for our exposition of cryptography and the fac- 
torization algorithm is defined and proven in Appendix D. 

The same holds for the results from continued fractions, which are presented in 
Appendix E. 

In Appendix F we present those elements of group theory that we need for 
our exposition of some quantum algorithms such as the hidden subgroup prob- 
lem in Sect. 6.6 as well as the stabilizer formalism for quantum error correction 
in Sect. 7.3.3. 

Appendix G contains a rigorous proof of the Quantum Adiabatic Theorem mak- 
ing use of resolvent operators and their properties. This result is then used in ana- 
lyzing the adiabatic method in Chap. 8. 

Finally, even though solutions to all exercises can be found in Appendix G.3 
the reader is encouraged to try to solve these problems. Attempting to do so will 
facilitate the learning process even if such attempts are unsuccessful. 


1.3 What is not in this Book 


Since this book is meant to be an introduction, not all aspects of the large and still 
growing realm of quantum computing can be presented here. The following list 
gives some of those topics that are not covered in this book. 


Methods of quantum mechanics Those who would like to learn something about 
the methods and results of quantum mechanics in analyzing physical systems, 
such as atomic spectra, symmetry groups and representations, perturbation the- 
ory, scattering theory or relativistic wave equations, are better advised to consult 
one of the numerous textbooks on quantum mechanics [37—40]. 

Interpretations of quantum mechanics Even though we consider the EPR para- 
dox and the BELL inequality and try to convey how these bring to the fore 
some counter-intuitive phenomena of quantum mechanics, we refrain here from 
a discussion of the foundations or even the various interpretations of quantum 
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mechanics. The reader interested in these aspects may consult [41—44] or the 
more recent explorations [45—47]. 

Physical implementations of quantum computers Neither do we touch on the 
myriad ways currently attempted to implement quantum gates, or even circuits 
and ultimately quantum computers. This has now become a fast moving field and 
presenting even a few of these efforts in a meaningful way would require a lot of 
additional material from various branches of quantum physics, such as nuclear, 
atomic, molecular, solid state physics or quantum optics. At the time of writ- 
ing no comprehensive review of the many ways currently explored to physically 
implement a quantum computer was available and the reader interested in this is 
best advised to search the internet. 

Complexity theory A thorough exposition of the information theoretic funda- 
mentals and questions around complexity theory would also exceed the intended 
scope of this book. To learn more about this, the reader may consult, for example, 
*Quantum Information Science' in [48]. 

Topological quantum computer This approach is both from the physical as well 
as the mathematical viewpoint very exciting and challenging. However, precisely 
because of the latter, the mathematical know-how required is quite extensive and 
would probably necessitate a (or even more) volume(s) on its own. A relatively 
recent introductory survey was given by NAYAK et al. [49]. 


These and other aspects are certainly important and interesting. But they would 
be misplaced in a book, which claims to be an introduction to the mathematics of 
quantum computing. 


1.4 Notation and References 


A detailed list of most of the symbols used in this book is given in the list of symbols 
preceding this chapter. In the following we give some additional general remarks 
about the notation used here. 

General HILBERT spaces are denoted by the symbol Н. For the two-dimensional 
HILBERT space of the qubits we use the symbol “Н. The n-fold tensor products are 
denoted by H®”, resp. "IH". 

For vectors in HILBERT spaces, we initially use the symbols y, ф,... After the 
concept of the dual space has been introduced, we use from thereon the DIRAC 
bra- and ket-notation |y), |9),... The symbols |”), |®) mostly denote vectors in 
composite multi-particle HILBERT spaces. For non-negative integers x and y less 
than 2", the vectors |x), |y), ... denote elements of the so-called computational basis 
in H”. 

Generally, capital letters like A, B, C, D, F etc. are used for operators on HILBERT 
spaces. Exceptions are: J, which denotes index sets, J and N, which denote natural 
numbers and L, which mostly stands for the bit-length of a natural number such as 
N. 
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The letters i, j, k, | are mostly used for indices. Except, of course, for the imag- 
inary unit i. For symbols with two or more indices such as, for example, a matrix 
Aj, we may insert a comma to improve readability and clarity. This does not alter 
their meaning. Whilst Aj; is just as clear as А; j, the comma in A;_3 7—2 is necessary 
to avoid almost inevitable misunderstandings if we were to write A;_3;_2 instead. 

We use both ways e^ — exp(A) to denote the application of the exponential func- 
tion to A and choose whichever makes a formula less cluttered. 

In this book we use natural physical units, such that A = 1, where i = x denotes 
the PLANCK constant divided by 27. This is why A does not appear in many expres- 
sions, where the pre-ordained reader might have expected it, such as the HEISEN- 
BERG uncertainty relation or the SCHRÓDINGER equation. 

Very often we provide a ‘justifying’ reference for a relation by making use of the 
following display method. 


L = R. 
—— 
(N.nn) 


This is to state that the reason L equals R can be found in equation (or a similarly 
referenced item) with number N.nn. 

Concerning the literature, Sect. 1.1 attempts to do justice to important histori- 
cal contributions and quotes references accordingly. In the remainder of this book, 
however, references will be given rather sparingly. This is not done with the inten- 
tion to deny the many original contributors a mentioning of their part in developing 
the subject. Rather, the intention is not to overload the reader of this introductory 
text with too many references. The more so, since all necessary material will be 
presented here. 


Chapter 2 A) 
Basic Notions of Quantum Mechanics шее 


2.1 Generalities 


Quantum mechanics is a theory making predictions about the statistics of micro- 
scopic objects (such as electrons, protons, atoms, etc.) often with implications for 
macroscopic phenomena. On such objects measurements of certain quantities can 
be performed the outcome of which are real numbers. Measurements with equally 
prepared objects show that the measured values occur with a relative frequency 
and are distributed around a mean value. Here the relative frequency is defined as 


relative frequency of number of measurements with result a 


measurement resulta ` total number N of all measurements 


and the mean value as 


relative frequency o 
mean value :— у ах : 1 . 
РЕЧИ ЕСЕ measurement result а 


In such measurements all observed objects have to be prepared in the same way. 
The following steps are then performed in an experiment: 


Calculation, such as of relative 


Preparation — Measurement — 
frequency and mean value. 


Quantum mechanics is a theory which provides a mathematical model for these 
steps and makes predictions about relative frequencies and mean values possible. In 
this context the following notions are used in quantum mechanics. 
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A measurable physical quantity is called an observable. 

The quantum mechanical prediction for the relative frequency of a mea- 
surement result is called the probability of the result. 

The quantum mechanical prediction for the mean value of an observable in 
a sequence of measurements is called expectation value. 

The preparation of objects that yields a statistical ensemble which results 
in distributions of measurement results and mean values for observables is 
described by a state. 


A particular class of such preparations— so-called pure states—can mathemati- 
cally be described by a vector in a HILBERT space. In their most general form—for 
so-called mixed states—the preparations are described by operators on a HILBERT 
space, which are positive, self-adjoint and have trace 1. Observables of the prepared 
objects are mathematically represented by self-adjoint operators on that HILBERT 
space. Together with the states (describing the ensemble of objects) the operators 
(describing the observable physical quantities) then provide a prescription for cal- 
culating probabilities and expectation values. 

In Sect. 2.2 we will thus first study the tool-set of this theory and exhibit the 
necessary mathematical objects and notions. 

In Sect. 2.3 we then turn to the physical applications of the mathematical objects 
in quantum mechanics. In doing so, we begin with a description of pure states in 
Sect. 2.3.1 before we cover the more general case of mixed states in Sect. 2.3.2. 


2.2 Mathematical Notions: HILBERT Spaces and 
Operators 


Definition 2.1 A HILBERT space lisa 


(1) complete complex vector space, that is, 
y,ocHanda,bce C > ay-bo cH, 
(ii) with a (positive-definite) scalar product 


(|): HxH —C 
(у,ф) — (yio) 


such that for all 9, Y, фі, 9» € H and a,b € C 
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(vie) = (ely) (2.1) 

(ly) 2 0 (2.2) 

(|у) 20€ w=0 (2.3) 
(Маф +b@2) = а(у|фі) + b(y|@2) (2.4) 


and this scalar product induces a norm 


П: H — R 


y — wy viv) Ce 


in which H is complete. 


A subset Hyp C H which is a vector space and inherits the scalar product and 
the norm from H is called a sub HILBERT space or simply a subspace of H. 


In the definition given here the scalar product is linear in the second argument 
and anti-linear (see Exercise 2.1) in the first argument. In some books the opposite 
convention is used. 

Because of (2.1) one has (y|w) Є R, and due to (2.2) the norm is thus well- 
defined. 


Exercise 2.1 Prove the following statements for the scalar product defined in 
Definition 2.1. 


(i) Foralla € C and y,g € H 


(ay|~) = a(v|e) (2.6) 
||аФф|| = |а|||Ф|| (2.7) 


(1) Fory € H 


II 
© 


(vp)-0 VpeH 5 y (2.8) 


(iii) For all y,ọ € H 


1 ; А | з 
(ию) = z (Ilv+olP—lly—ol? +illy iol? -illy+igl?). 0.9) 


For a solution see Solution 2.1. 
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Completeness of Н in the norm ||-|| means, that every in H CAUCHY-convergent! 
sequence (Ф„)һе C H has a limit іт, .„„ 9, = ф Є Н that also lies in H. Finite- 
dimensional vector spaces, which are the only cases relevant for us in this book, are 
always complete. 


Definition 2.2 A vector y € H is called normed or a unit vector if ||y||=1. 
Two vectors y, € H are called orthogonal to each other if (w|) = 0. The 
subspace in H of vectors orthogonal to y is denoted by 


Hy; := (e € H| (иф) = 0}. 


Exercise 2.2 Let y, 9 € H with || y|| 4 0. Show that 


(vie) 
hale 


Ф— y E Hy 


and illustrate this graphically. 


For a solution see Solution 2.2. 


Definition 2.3 Let Н be a HILBERT space and / an index set. A set фу | j € 
I) C H of vectors is called linearly independent if for every finite subset 
(91,€0...., Qn} and a, € C withk=1,...,n 


411 d- 425 +++: Fann = 0 


holds only if a, = a? = ··· = an = 0. 

A HILBERT space Н is called finite-dimensional if H contains at most 
n = dimH < ee linearly independent vectors; otherwise ІН is called infinite- 
dimensional (dim H = оо), 

A set of vectors {@;| j € Г} C His said to span Н if for every vector ф c H 
there are aj € C with j € J such that 


p 


jel 


ТА sequence (Фу) jer is called CAUCHY-convergent, if for every, € > 0 there exists an N(£) such 
that for all m,n > N(€) onehas ||ф, — Qy|| < €. 
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which is expressed by writing 
Н = Span(o;| j € Г}. 
A linearly independent set {@;| j € Г} of vectors that spans Н is called a 


basis of Н and the vectors фу of such a set are called basis vectors. A basis 
{e;| j € I} СН whose vectors satisfy 


0ifjzk 
(еер) = бд = { m | Д 7 (2.10) 


is called an orthonormal basis (ONB). The HILBERT space H is called sep- 
arable if it has a countable basis. 


Example 2.4 
21 


with the usual scalar product 
n 
(dw) := У, zw; 
j=l 


is a HILBERT space of dimension n. An ONB for it is given by the countable set of 
basis vectors 


1 0 0 
0 1 0 
e= 0 › ё = 0 4 › Ёп = 0 
0 0 1 


We will encounter HILBERT spaces of this type time and again in the context of 
quantum computing. 


In general quantum mechanics makes use of infinite-dimensional HILBERT spaces. 
If the position or the momentum of a particle that has to be described by quan- 
tum mechanics were our observables of interest, we would have to use the infinite- 
dimensional HILBERT space of Example 2.5. 
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Example 2.5 Let d?x denote the LEBESGUE measure [50] in R?. Then 
L? (R?) := fy :R?—>C| L | w(x) |? dx < =} 
R? 
with the usual scalar product 


(vile) = | vivi Go? 


is an infinite-dimensional HILBERT space, which is used to describe position and 
momentum of a particle in three-dimensional space. 


In general, however, the position or the momentum of a particle are not observables 
that are relevant in the context of quantum computing, which is why we will not 
consider L? (IR?) any further. 

Rather than position or momentum of a particle, the quantum computational pro- 
cess generally observes and manipulates intrinsic quantum observables such as spin 
or (photon) polarization. In order to understand the aspects of quantum mechan- 
ics relevant for computing it is thus sufficient to consider only finite-dimensional 
HILBERT spaces. These are necessarily separable. Where possible we shall intro- 
duce further notions in the most general form regardless of the dimension of the 
underlying space H. But in doing so we will mostly ignore the additional mathemat- 
ical detail required in the infinite-dimensional case, such as convergence for infinite 
sums or densely defined domains of operators. Including all of these would overload 
the presentation and unnecessarily distract from the essential features of quantum 
computing. In particular, we will only consider separable HILBERT spaces. 

Every vector y € Н can be expressed with the help of a basis (ej) and complex 
numbers (aj) 


v=} ajej. 
J 


For a given basis this so-called basis expansion y is unique because y = Y;bje; 
implies that У (а; — b;)e; = 0 and due to the linear independence of the e; it then 
follows from Definition 2.3 that we must have a; = bj. 

If (ej) is an ONB, then we have a; = (e;|V), that is, 


у= Y e;lv)e; (2.11) 


J 


and 


у? = ei). (2.12) 
J 


These claims are to be shown in Exercise 2.3. 
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Exercise 2.3 Let y,@ c H and {е;} be an ONB. Moreover, let y; = (e;|w) and 
similarly 9; = (е;|ф). Show that 
(i) 
y — » (ejlv)e; = ive 
j 
(ii) 
(aly) = Y (еф) (елу) = X (eles) (елу) УДА (2.13) 
j j 
(iii) 
м? = (елу) -Xlwf (2.14) 
(iv) рє Hy, then 
2 2 2 
Ile + vil = Hell + 1и”. Q.15) 
This is a generalized version of the Theorem of PYTHAGORAS. 
For a solution see Solution 2.3. 
Another useful relation is the SCHWARZ-inequality 
(vig)! < lvii lell, Q.16) 
which is to be proven in Exercise 2.4. 
Exercise 2.4 Show that for any 9, y c H 
Kylo) < lil lloll. (2.17) 


First consider the case y = 0 or 9 = 0. In the case y 5 0 Z ọ use Exercises 2.2 
and 2.3 and make a suitable estimate. With the help of (2.17) show that also for any 


Q,ycH 
Iv t ell € (ФІІ. 


For a solution see Solution 2.4. 


(2.18) 


With the help of the scalar product every vector y € H defines a linear map from Н 


to C, which we denote by (y| 
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(y|: H — C 


. 2.19 
ф — lylo) кы 


Exercise 2.5 Show that the map defined in (2.19) is continuous. 


For a solution see Solution 2.5. 


Conversely, it can be shown (see Theorem of RIESZ [51]) that every linear and 
continuous? map from Н to C can be expressed with a y € Н in the form given 
in (2.19) as (y|. This means that there is a bijection between Н and its dual space 


H* := (f : H С | f linear and continuous}. 


Essentially, this bijection states that every linear and continuous map from H to C 
is uniquely represented as a scalar product with a suitable vector in H. 

The dual space Н“ of a separable HILBERT space Н is also a vector space with 
the same dimension as Н. This identification? of Н with Н“ motivates the ‘bra’ and 
‘ket’ notation derived from the word bracket and introduced by DIRAC. Bra-vectors 
are elements of Н“ and are written as (9|. Ket-vectors are elements of Н and аге 
written as |y). Because of the above-mentioned bijection between the HILBERT 
space H and its dual space H* each vector |ф) € H corresponds to a vector in H*, 
which is then denoted as (4. 

The application of the bra (the linear map) (9| on the ket (the vector) |y) as the 
argument of the linear map is then the ‘bracket’ (|y) € C. One writes (2.11) in the 
form 


Iv) = dle) (ely). (2.20) 
J 


With (2.20) and the notation A| y) = |Aw) one then has 


Aly) = Ay) = $ |е) (Аҹ) — les) (еЛА Y lex) (exl) 
J (2.20) Ї k 


=, È |е) (еден) (erly). 
(2.4) ik 


Therefore, we can express A in the form 


A — У |е) (ej|Aex) (е = У |е) Аж (ек, (2.21) 
j,k jk 


Continuity needs to be mentioned separately only in the infinite-dimensional case. In finite- 
dimensional spaces every linear map is necessarily continuous. 


?Identified with each other are the sets, but not the linear structures of the vector spaces, since the 
bijection H > |ф) — (ф| Є Н“ is anti-linear. 
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where A у :— (e;|Aex). This motivates the following definition. 


Definition 2.6 For an operator А on a HILBERT space Н and an ONB {|е;)} 
in H one defines 
A jx = (e;|Aex) (2.22) 


as the (j,k) matrix element of A in the basis []ej)). The matrix 
(A jx) j,e=1,...,dimH is called the matrix representation or simply the matrix 
of the operator A in the basis {|e;)}. The same symbol A is used to denote the 
operator and its matrix. 


For any finite-dimensional HILBERT space H with dimH = n and a given ONB 
lle) } СН we can define an isomorphism H 2 C" by identifying the given basis 
with the standard basis in С”, in other words, we make the identification* 


1 0 

у= |. «sdeo2 |: |. (2.23) 
à 0 
0 1 


Likewise, we have for the dual basis? 
(е\| = (10...0),...‚ е = (0...01). (2.24) 


In (2.23) the right side of each equation is a column vector, which may be considered 
a complex n x 1 matrix, whereas in (2.24) it is a row vector, which may be viewed 
as a complex 1 x n matrix. The operator |e;) (e;| is the product of an n x 1 matrix 
with an 1 x n matrix, which turns out to be an n x n matrix. In the basis {|e;}} this 
matrix is then found to be 


^Strictly speaking, these are not equalities between the vectors |e,) € HI and the standard basis in 
С". Rather, we have a linear map, that is, an isomorphism of HILBERT spaces 1: H — C" and, 
1 
0 
for example, 1(|е1)) = | . |. But the agreed convention, which we have adopted here, is to state 


0 
equality without writing out : explicitly. 


>This is actually a basis ((u;|)) of the dual space Н“ satisfying (иле) = 5, а. But as remarked 
before, we can identify H* with H and thus ((u4|]) ) = {(eq|}}. 
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1 /0 
0 1 k n 
leje — j| 1| (0 ото 0) 
0 
n WO 
1 k n 
1 | 
: | 
= ] 1 а (2.25) 
п 


where the row above a matrix shows the column indices and the column to the 
left indicates the row indices. Only the non-zero element in the matrix is shown, in 
other words, all other matrix elements apart from the j,k matrix element are zero. 
In particular, the matrix of [е;) (е; would be zero everywhere, except for the j-th 
entry on the diagonal, which would have the value 1. 

As can be seen from (2.23) and (2.24) the vector in C" identified with (e;| is just 
the transpose of the vector in C" identified with |e;). This holds generally and we 
have that 


bi 
I) = Ре) = | : e (yl = Уре  (br...b.), (2.26) 
7 bn (2.33) J 
such that with a 
ai 
le) = Хале) = | : 
7 ап 
we then obtain 
ај aibi ... аф, 
lo)(y| = (bi... b= 3 © |: (2.27) 
аһ anbi заара 


When the operator |@) (y| is multiplied by a number z € C we also use the notation 
Ie)z(y] := z|e) (y|, such that 
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aibi re aby 
lp)z(y| =z 


Andy... Anby 


Example 2.7 Let H 2 C? be a two-dimensional HILBERT space with an ONB 
{|0),|1)}, which we identify with the standard basis in C? by 


Likewise, we have for the dual basis {(e,|} C H* 2 H the identification 
(o= (10),  @ļ=(01) 


in Н" 2 H & С?. For the operators |х) (y| : Н — Н with x,y € {0,1} we then find 
from (2.27) that 


|0)(0| = (0) (10) = l6 d ioa = (0) (01 = n 5 


0 00 0 00 cen 
по = (0) 10) = (89) и (8) о) = (08). 

where the matrices аге in the standard basis of C2. With 

|p) 2a|0) +510), — |w) =c|0) - d|t) 
we thus obtain for a general |o) (y| : H — H 

lo)(w| = (al0) +01)) (e(0] - a(1]) 
= ac|0)(0| 4- ad|0) (1| + bc|1) (0| + bd |1) (1| 
ac ad 
Sot, is а) | ee) 


(2.28) 


From now on we shall use the bra-ket-notation for vectors |р) € Н and their cor- 
responding elements (ф| € Н“ in the dual space. However, in order not to overload 
the notation we may drop the bra-ket-notation, if the vector appears as an argument 
of a function. For example, instead of |||) || we shall simply write || ||, where, of 
course, y and |y) denote the same vector in H. 
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Definition 2.8 A linear map A : H — His called an operator on the HILBERT 
space Н. The set of all operators on Н is denoted by UH). A linear map 
T : UH) — ЦН), that is, an operator acting on operators, is called a super- 
operator. 

The operator A* : H — H that satisfies 


(A'v|e) = (wlAe) Viy), |[ф) ЄН (2.30) 


is called the adjoint operator to A. If A* — A then A is called self-adjoint. 


In the infinite-dimensional case this means that A and A* are densely defined and 
have the same domain on which they coincide. In the finite-dimensional case self- 
adjoint is the same as hermitian. To be precise, A* is actually a map A* : H* — H* 
but as mentioned before we can identify H* with H. 

In Exercise 2.6 it is to be shown that A is self-adjoint if and only if its matrix 
elements satisfy Ак; = A jy. 


Exercise 2.6 Show that 


(i) 
(А*)* = А (2.31) 
(ii) For any ce С 
(cA)* = сА* (2.32) 
(iii) 
(Ay| = (wlA", (2.33) 


where the right side is understood as the map H Zu C and (y| and (Ay| 


are as given in (2.19). 


(iv) o 
Аў = Аџ; (2.34) 
such that 
А=А © Ay =Aje. (2.35) 
(v) For any |y). |o) € Н | 
(e) (wl) =) (| (2.36) 


For a solution see Solution 2.6. 
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Definition 2.9 An operator U on Н 15 called unitary if 


(Uv|Uo) = (vio) Viw),|e) ЄН. 


The set of all unitary operators оп Н is denoted by (ЇН). 


Unitary operators have their adjoint operator as their inverse and do not change 
the norm. 


Exercise 2.7 Show that 
UcUH) = U'U-1 e JUvl|-lwl Vly) ЄН, (2.37) 
where 1 is the identity operator on H. 


For a solution see Solution 2.7. 


Definition 2.10 Let A be an operator on a HILBERT space Н. A vector |y) € 
Hx {0} is called eigenvector of A with eigenvalue A € C if 


Aly) = A|v). 


The linear subspace that is spanned by all eigenvectors for a given eigenvalue 
A of an operator А is called eigenspace of A and denoted by Eig(A, л). An 
eigenvalue A is called non-degenerate if its eigenspace is one-dimensional. 
Otherwise, À is called degenerate. The set 


o(A) :— {A € C| (A — A1)! does not exist} 


is called the spectrum of the operator A. 


Eigenvalues of an operator A are thus per definition contained in the spectrum 
of A. In infinite-dimensional HILBERT spaces the spectrum of an operator may—in 
addition to the eigenvalues—also contain a so-called continuous part. Since in this 
book we are dealing exclusively with finite-dimensional HILBERT spaces, we may 
identify the spectrum of an operator with the set of its eigenvalues for all operators 
we are dealing with here. 

The eigenvalues of self-adjoint operators are always real and the eigenvalues of 
unitary operators always have absolute value 1. 
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Exercise 2.8 Let A] yw) = А |y). Show that: 
© = 
(vi4* = Atyl. 
(ii) The eigenvalues of a self-adjoint operators are always real. 


(iii) The eigenvalues of a unitary operators have absolute value 1. 


For a solution see Solution 2.8. 


Self-adjoint operators are diagonalizable, that is, for every self-adjoint operator A 
there is an ONB consisting of eigenvectors 4 |е; и) ) of A such that 


Ale j.a) = Лезо) : 


The matrix elements in this basis have the form A; „в = А5; бо g and thus (2.21) 
becomes 
A= У |е;о)А;ӧ до p (exg| = day leja) lejal. (2.38) 


j,k,æ,ß 


Expressing a self-adjoint operator with the help of its eigenvalues and eigenvectors 
as in (2.38) is referred to as writing the operator in its diagonal form. 

In the finite-dimensional case it is fairly straightforward to show that the smallest 
and largest eigenvalues of a self-adjoint operator A serve as lower and upper bound 
of the scalar product of (y|A v) for |y) normalized to 1. 


Exercise 2.9 Let H be a HILBERT space with dimH = d « ~ and let A be a self- 
adjoint operator with eigenvalues (A j | j€tL...d H satisfying 


А € Ao € € Àg. (2.39) 
Show that then for any |y) € H with ||w|| = 1 

Ài € (V|Av) < Ал (2.40) 
holds. 


For a solution see Solution 2.9. 
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An important and special type of operator is what is called projection or projector. 


Definition 2.11 Let H be a HILBERT space. An operator P € ЦН) satisfying 
P? = P is called a projection or projector. If in addition P* = P, then P is 
called an orthogonal projection. 

Let Hus be a subspace of H. If Pup is an orthogonal projection and satisfies 
Pawl Y) = |y) for all |y) € Нуль we call Pub the projection onto this subspace. 


Exercise 2.10 As in (2.38) let the |е; œ) with a € {1,...,d;} be orthonormal eigen- 
vectors for the possibly d;-fold degenerate eigenvalues A; of a self-adjoint operator 


A. Show that then 
dj 


P;= Y leja) lejal (2.41) 


a=1 


is the projection onto the eigenspace Eig(A,A;) for the eigenvalue A; and d; = 
dimEig(A,;). 


For a solution see Solution 2.10. 


With Pj thus defined, we can write any self-adjoint A in the form 


А = SA len) eral = = УАР. (2.42) 


etm peri j 


Note that any ONB {|e;)} constitutes an ONB of eigenvectors of the identity oper- 
ator 1 for the eigenvalue 1. Hence, (2.42) implies that for any ONB {|e ;) } 


1 = LÀ?) (еек) ler] = ZÈ ne) ed = е) ei = EP. (2.43) 


Q. ai Q. die i 


where P; = |e;)(e;| denotes the projection onto the subspace spanned by |e;). Due 
to the |e;) being orthonormal these projections furthermore satisfy 


Р/Р, = |е) (елек) (ек| — _‚бу|еу)\ек| = еу) (6 = ÖP}. (2.44) 
(2.10) 


Generally, for each orthogonal projection P there is a set of orthonormal vectors 
{| yj) } such that 


P= Уу) (11. 
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In case this set consists of one normed vector |y) only, P is called a projection onto 
|y) and it is denoted as Py. In other words, for a |y) with ||| = 1 we have 


Py := |у) (y 


as the orthogonal projection onto |y). 


Exercise 2.11 Let P be an orthogonal projection. Show that then a set of orthonor- 
mal vectors (|y;)) С H exists such that 


Р= Уу) (11. 


Hint: From P? = P = P* deduce the possible eigenvalues of P and use (2.42). 


For a solution see Solution 2.11. 


Definition 2.12 Let H be a HILBERT space. An operator A € HH) is called 
bounded if 


ПАП :— sup{||Ayl| | |y) € Hand ||w]| = 1) « ee (2.45) 


and in this case ||А|| is called the norm of the operator A. We denote the set 
of bounded operators on H by B(IH). The set of bounded self-adjoint operators 
on H is denoted by Bs,(H). 

A self-adjoint operator A is called positive if for all |y) € H 


(v|Av) 7 0, 


which is written as A > 0. A self-adjoint operator A is called strictly positive 
if (w|Ay) > 0 for all |y) € Hx {0} and this is denoted by A > 0. For two 
operators A and B the statement A > B is defined as A — B > 0 and, likewise, 
A > B is defined as A — B > 0. 

Furthermore, one defines the commutator of two operators A and B as 


[A,B] :— AB — BA. (2.46) 


We say A and B commute if their commutator vanishes, that is, if [A,B] = 0. 


If H is infinite-dimensional, these definitions have to be slightly amended. How- 
ever, since in this book we deal only with finite-dimensional H, Definition 2.12 
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is sufficient as is for our purposes. For the same reason we will only encounter 
bounded operators in this book. 


Exercise 2.12 Let H be a HILBERT space. Show that for A, B € B(H) one has 
(AB)* = B*A* (2.47) 
and that if A,B € B,4(IH then 
(AB*-AB e |AB|-0. (2.48) 
Furthermore, show that for any c > 0 
A'AXcBB = ||д|<у/с||В|, (2.49) 
such that 


АА<ӘӢ e Ау. 


For a solution see Solution 2.12. 


Using the result of Exercise 2.9 allows us to show that the norm of a bounded self- 
adjoint operator is given by the absolute value of its largest eigenvalue. 


Exercise 2.13 Let H be a HILBERT space with dimH = d < œ and let A € В,„(Н) 
with a set of eigenvalues o(A) = (A;| j € {1,...,d}} such that 


А € Aa € € Àg. 


Show that then 
IlAI] = (Аа (2.50) 


holds. 


For a solution see Solution 2.13. 


Further relations for operator norms, which will be useful for us, are to be shown as 
Exercise 2.14. 


Exercise 2.14 Show that for all operators A,B € B(H), vectors |у) € H anda c C 
one has 


Awl] < ПАМІ (2.51) 


28 2 Basic Notions of Quantum Mechanics 


IIABI| < |A|] BI] Q.52) 
||A+ В| < А+ ||В|| (2.53) 
||аА|| = lal [IA T] (2.54) 


and that every projection P on Н and every unitary operator U € (Н) satisfy 


ПР = 1 = 1011. (2.55) 


For a solution see Solution 2.14. 


It turns out that the sum of the diagonal matrix elements of an operator A does not 
depend on the basis chosen to calculate it, that is, every two ONBs { |е) }, {|e;) } 


satisf 
И Yej4ej) = Y (dA). 
k 


J 


which is to be shown as Exercise 2.15. 


Exercise 2.15 Let {|e;)} be an ONB in a HILBERT space H and A, U € ЦН) Show 
that then: 
(i) 

{|é)=Ule;)}isONBinH = — UcH). (2.56) 


(ii) 
У(е14е)) = УА). 


Ј Ј 


For a solution see Solution 2.15. 


This invariance property of the sum of diagonal matrix elements allows us to define 
an important map tr : L(H) — C known as the trace. 


Definition 2.13 Let {|e;)} be an ONB in a HILBERT space Н. The trace is 
defined as the map 


tr: UH) — C 
A + tr(A):= Xj(ejMej), = Y.jAjj 5 (2.57) 
Q.22) 


For any A € L(H) the expression tr (A) is called the trace of A. 
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The trace is a linear map since for any A, B c ЦН) we have (A+B) ;; 2 Aj; 4- Bjj. 
Two of its further properties are to be shown in Exercise 2.16. 


Exercise 2.16 Show that the trace has the following properties: 


(i) For all A,B € ЦН) 
tr (AB) = (ВА). (2.58) 


Gi) For B € ЦН) 
tr(AB)=0 VACL(H) © B=0. (2.59) 


For a solution see Solution 2.16. 


2.3 Physical Notions: States and Observables 


As mentioned before, quantum mechanics is a theory, which in general only allows 
statements about the statistics of the system described. The statement “а system is 
in a given state’ thus means that the system has been prepared as a member of a 
statistical ensemble and the observable statistics of this ensemble can be calculated 
with the help of the mathematical object representing this state. For the selection 
of the mathematical object to describe the ensemble one distinguishes between so- 
called pure states and the more general case of mixed states, which we shall discuss 
in Sect. 2.3.2. 

To begin with, the specification of the mathematical objects used to describe cer- 
tain physical entities will be given in the form of five postulates. Further mathemati- 
cal objects, which may be related to physical quantities, will then still be introduced 
in the form of definitions. 


2.3.1 Pure States 


Postulate 1 (Observables and Pure States) An observable, that is, a physi- 
cally measurable quantity of a quantum system is represented by a self-adjoint 
operator on a HILBERT space H. If the preparation of a statistical ensemble 
is such that for any observable represented by its self-adjoint operator A the 
mean value of the observable can be calculated with the help of a vector 
|y) € H satisfying ||w|| = 1 as 
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then the preparation is said to be described by a pure state represented by the 
vector |y) € H. One calls |y) the state vector or simply the state, and (A) y, 
is called the (quantum mechanical) expectation value of the observable A in 
the pure state |y). 

The space H is said to be the HILBERT space of the quantum system. 


We will often refer to a quantum system by its HILBERT space. In other words, if a 
system designated by S is described by states in a HILBERT space HS, we will sim- 
ply speak of the ‘system HS’. Likewise, given that every observable is represented 
by a self-adjoint operator, we shall from now on use the same symbol to denote the 
observable as well as its associated operator. 

It is somewhat intuitive that we require 


(2), = ПИ =1 (2.61) 


for any state vector |y). This is because the operator 1 can be interpreted as the 
observable ‘is there anything present.’ For systems containing any quantum mechan- 
ical object such an observable should always have the expectation value 1. 

Using the diagonal representation of any self-adjoint operator A in terms of its 
eigenbasis, the expectation value of the observable represented by A becomes 


(yay) = у Уер) (елу) = lle) ely) 
(2.60) (2.38) j ол) і 


Indeed, in measurements one always observes an element of the spectrum (see 
Definition 2.10) of the associated operator. In the case where the system is described 
by states in an infinite-dimensional HILBERT space, these observations may also 
include elements of the so-called continuous spectrum of the operator. As already 
mentioned a couple of times, we restrict ourselves here exclusively to finite- 
dimensional systems. For our purposes we can thus identify the eigenvalues (Àj) 
of a self-adjoint operator A as the possible measurement results of the associated 
observable. In the case of a purely non-degenerate spectrum the positive numbers 
(елу) s are interpreted as the probabilities with which the respective value A; is 
observed. This is formalized more generally in the following postulate. 


Postulate 2 (Measurement Probability) /n a quantum system with HILBERT 
space H the possible measurement values of an observable are given by the 
spectrum O(A) (see Definition 2.10) of the operator A € В.Н) associated 
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with the observable. The probability Py(A) that for a quantum system in the 
pure state |y) € H a measurement of the observable yields the eigenvalue À 
of A is given with the help of the projection Ру, onto the eigenspace Eig(A,/) 
of À as 

Py(A) = РАМ). (2.62) 


That (2.62) indeed defines a probability measure (see Definition A.2) on the spec- 
trum of A requires in the general case a technically demanding proof [50]. Here we 
provide the following plausibility argument for the case of a purely discrete spec- 
trum o(A) = {A;| j € I} with eigenvalue degeneracies d; = dimEig(A,/;) and an 
ONB of eigenvectors (e; æ) | j€La € {1,...,dj}}. In this case we have 


Pya) = |Р) is 


dj 
Li | (оу) |? > 0. 
(2.62) (2.41) Е 


(2.12)& 


dj 
у leja) (6j.al V) | 
a=1 


(2.63) 
That these terms add up to | then follows from the requirement made in Postulate 1 
that states |y) be normalized to 1. 


Уру) = >| ||| EFÈ еы? e = 1и 1. 


jel dem jer Q.63) €! 01 eim 12) 


Hence, the map Py(-) : с(А) — [0,1] can be viewed as a probability measure on 
o(A). 

As a consequence of (2.60) one also finds that for any observable A and complex 
numbers of the form е! € C with œ € R one has 


(Ац) = (wlAw) = (А), 


. = io ia = 
(A) ciay — Де y|Ae'" y) Z 
(2.60) (2.4),(2.6) 


that is, the expectation values of any observable A in the state е! |y) and in the state 
|y) are the same. Since 


2 E 2 2 
(ед = ette] = Kylen] 
(2.6) 
the measurement probabilities in the two states are also the same. This means that 


physically the state е! |y) € Н and the state |y) € Н are indistinguishable. In other 
words, they describe the same state. 
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Definition 2.14 For every |y) € H with ||| = 1 the set 
Sy = (еу) |a € R} 


is called a ray in H with |y) as a representative. 


Every element of a ray Sy describes the same physical situation. The phase a € R 
in e'* can be arbitrarily chosen. More precisely, pure states are thus described by a 
representative |y) of a ray Sy in the HILBERT space. In the designation of a state 
one uses only the symbol |y) of a representative of the ray, keeping in mind that 
|y) and е! |y) are physically indistinguishable. We shall use this fact explicitly on 
several occasions. 

Conversely, every unit vector in a HILBERT space H corresponds to a physical 
state, in other words, describes the statistics of a quantum mechanical system. If 
|p), |W) € H are states, then a|9) + bly) € H for a,b € C with |lap+by|| = 1 
is a state as well. This is the quantum mechanical superposition principle: any 
normalized linear combination of states is again a state and thus (in principle) a 
physically realizable preparation. 

A word of caution, though: whereas the global phase of a linear combination is 
physically irrelevant, this is no longer true for the relative phases in the linear com- 
bination. More precisely, H |o), |y) € H be two states satisfying (|y) = 0. Then 
v5 e) + |w)) as well as ve) + ei^ |y)) are normalized state vectors. However, 


while |y) and ei^ |y) represent the same state, that is, describe the identical physical 
situation, the states —= ve) +|w)) and + a (I) + el^ |y)) do differ and correspond 
to different physical шаш This is NAR for any observable A we have 


Adot хе (0+ viAQo-- v))) 

(2.60) 

1 
x 5 ((ФЇАФ) + (viAv) + (elAv)  (v|Ae)) 
=, (оо) + (wl) + (olay) + vio) 
(2.30), A*=A 
7 5 (00,4) y) + Re((olAy)) 
(2.60),(2.1) 


where the term with the real part Re((@|Ay)) contains the so-called interference 
term. Exactly this term is different in the state —~ aa (I) +e!|y)) because, similarly, 
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(А) 19) cele уу) у = (p ss e*y|A(o ss el^ y) 
((Ф|Аф) + (e"w|Ae'* y) 4- e (p|Av) +e " (yJAo)) 


((4)y + (A) y) +Re (ерду). 


NIE NI NIE 


and for (p|Ay) 7 0 the real part of (p|Ay) and of ei^ (o|A y) differ. In other words, 
while changing œ € R in e'* |y) does not change the state, this is no longer true for 
L (l) e ]y)). 

If a system is prepared in a state |y), how likely is it that a measurement reveals 
it to be in a state |ф)? This is answered by the following proposition. 


Proposition 2.15 Let the states of a quantum system be described by the rays 
in a HILBERT space H. If the system has been prepared in the state |y) € H, 
then the probability to observe it in the state |p) € His given by 


System prepared in state |W) | _ 2 
EE in state |) = |(ф|ұ) |>. (2.64) 


Proof Let |у), |ф) € H with ||w|| = 1 = ||ф||. The observable we measure when 
querying if the system is in the state |ф) is the orthogonal projection Р, = |9) (Ф| 
onto that state. This observable has the eigenvalues 0 and 1. The eigenvalue А = 1 
is non-degenerate and its eigenspace is spanned by |@), hence the projection onto 
the eigenspace for eigenvalue A = 1 is also given by Py and (2.62) of Postulate 2 
becomes 


Py(A=1) = ПРМ)? = |Pw] = Ille) Celo? 


— 2 2 __ 2 
= ily) lel = ely). 
(2.7) A 


How widely around its expectation value are the measurement results distributed? 
A statement about that is given by the so-called uncertainty or standard devi- 
ation defined similarly to the same notion in standard probability theory (see 
Appendix А). 


Definition 2.16 The uncertainty of an observable A in the state |y) is 
defined as 
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Ayla) = yla- D^) = (а (И?) св 


If the uncertainty vanishes, that is, if Ay(A) = 0, one says that the value of 
the observable A in the state |w) is sharp. 


A sharp value of an observable A in a state |y) means that all measurements of A 
on systems in the state |y) always yield the same result. This is the case if and only 
if |y) is an eigenvector of A as stated in the following proposition. 


Proposition 2.17 For any observable A and state |y) the following equiva- 
lence holds 


Ay(4)-0 = Aly) = (А) |). 


Proof Since as an observable A is self-adjoint, that is, A* = A, we have 


(А) у= МАМ) = (A viv) = (Avv), = (WIAW) — (А), 
(2.60) (2.30) (2.1) (2.60) 


and it follows that (A) y € R. Consequently, 
1) -A- (A),1 (2.66) 


as well and thus 


(ду(4))? = (WI(A= 4,1)? v) = ((А— (1) v] (4 — 4), 1) v) 
(2.65) (2.30) 
= и-и). (2.67) 
(2.5) 


such that 


A(A)-0 е, Ау) = Alv) 
(2.5),(2.3) 


that is, the value of the observable A is sharp if and only if |) is an eigenvector of 
A with eigenvalue (A) 


ye 
A state which is an eigenvector of an operator associated to an observable is also 
called an eigenstate of that operator or observable. 
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A preparation in an eigenstate of A thus implies that all measurements of A in that 
state always yield the corresponding eigenvalue. The converse is also true: If for a 
given preparation the uncertainty of A vanishes, then the preparation is described by 
an eigenstate of A. 


Definition 2.18 Two observables A and B are called compatible if the asso- 
ciated operators commute, that is, if [A,B] = 0. If [A,B] Z 0, they are called 
incompatible. 


A result from linear algebra tells us that A and B self-adjoint and [A,B] = 0 
implies that there is an ONB {|e;)}, in which A and B are diagonal, that is, 


A=Yiajle;){e;| and в= У Ье) (е. 
Ј Ј 


A system in the state |е) is then in an eigenstate of A and B. Hence, measurements 
of compatible observables A and B in this state yield sharp results (here a, and bg) 
for both these observables and do not exhibit uncertainty. 

However, the product of the uncertainties of incompatible observables is bounded 
from below as the following proposition shows. 


Proposition 2.19 For any observables A,B € В,„(Н) and state |y) € H the 
following uncertainty relation holds 


(2.68) 


Proof 'The relation (2.68) is a consequence of the following estimates 


(4y(A))°(4y(B))” 
= lle- онди |o mne] 
(2.67) 
> ka- adye- (В) 1) | 
(2.16) 
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(A— 00,1) (В (9), 1) v) -= B- 09,1) vI (A (00,1) 9))- 


From (2.68) we see that if for a state |y) we have | (А, B]) ,, | > 0 then the product 
of the uncertainties of the observables A and B in the state |y) is bounded from 
below. The smaller the uncertainty of A the bigger that of B and vice versa. 


Example 2.20 The HEISENBERG uncertainty relation is a special case of (2.68), 
where Н = L? (R?) (see Example 2.5) and A is given by one of the position operators 
Q; and B by one of the corresponding momentum operators P; for the three spatial 
dimensions j € {1,2,3}. For these two operators one has the following action on 
states? |y) € H = L? (R3) 


Ov) = y) 
Ри) (х) = 1-1-0 удо), 
Ј 


such that 


IQ; All) = |i i (99069) = idal, 


Xk 


that is, [Qj, P] = iô;x1. Consequently, in this case 


1 
Ay(Q;) Ay(Pk) = E 


A measurement of an observable A = Y; À;|e;) (е; on an object prepared in the state 
lw) = Xjlej)(ej|w) yields an eigenvalue A, € o(A). Out of the possible measure- 
ment values o (A) for A a value A, has been observed. Оп an object for which Ax 
has been measured and which has not been influenced by any outside interaction, 


As always in this book, here the system of units with Й = 1 is used, since otherwise one would 
have for the momentum operators P; = —1Й 2. 
е T 
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another measurement of A thereafter always yields the value A, again. The set of all 
such prepared objects, in other words, objects originally in |y) that yield the value 
Ак upon measurement of A, then constitutes a preparation in which A has the sharp 
value A;. Such a state is to be described by the eigenvector |e;,) of A. Accordingly, a 
measurement of an observable A that yielded the value А; € o (A) can be viewed as 
a preparation of the object in the state |e,) € H. One says that with the probability 
(еду) 2 the measurement ‘forces’ or ‘projects’ the object that was originally in the 
state |y) into the eigenstate |e;) of the measured observable. Selecting all objects 
with the measurement result Ау, we have thus prepared an ensemble that is described 
by vectors |е) in the eigenspace of А. This physical phenomenon is formulated as 
the Projection Postulate. 


Postulate 3 (Projection Postulate) If a measurement of the observable A on 
a quantum mechanical system in the pure state |y) € H yields the eigenvalue 
À, then the measurement has effected the following state transition 


ly) = state before measurement Ру |у) _ State after 
"measurement \|P,|w)|| | measurement, 


where Py is the projection onto the eigenspace of А. 


Historically, the state |y) of a quantum mechanical system has also been called 
wave function. For this reason the Projection Postulate is also known as collapse 
of the wave function. 

A state can also change without a measurement being performed on it. The time 
evolution of a state not caused by measurements is given by a unitary operator 
obtained as a solution of an operator initial value problem. 


Exercise 2.17 Let H be a HILBERT space and for t > tọ let t — U(t,to) € ЦН) be 
a solution of the initial value problem 


d 
i— U(t,to) = H(t)U(t,t 
кл, (2,00) (t)U (t, to) (2.69) 
U (to, to) =i. 
where H(t) € Bsa(H). Show that then U(t,fo) is unitary and unique. 


For a solution see Solution 2.17. 


We will not concern ourselves here with the notoriously difficult and technical 
aspects of the existence of solutions t +> U(t,fo) to (2.69), but will always assume 
that H(t) is such that a solution exists and is unique. 
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Postulate 4 (Time Evolution) In a quantum system with HILBERT space H 
every change of a pure state over time 


no measurement 
—À 


|w(to)) = state at time to |w(t)) = state at time t 
that has not been caused by a measurement is described by the time evolution 
operator U(t,to) € Ц(Н). The time-evolved state |w(t)) originating from |Wo) 
is then given by 

|w(t)) = U(t,to)|w(to)) - (2.70) 


The time evolution operator U(t, to) is the solution of the initial value problem 


4 
і U(t.t0) = Н(0)0 (е) (2.71) 


U (10,10) = 1, 


where H(t) is the self-adjoint HAMILTON operator (aka Hamiltonian), 
which is said to generate the time evolution of the quantum system. 


The operator version of time evolution given in Postulate 4 is completely equiv- 
alent to the well-known SCHRÓDINGER equation" 


i“ 0) = Н), ол?) 


which describes the time evolution of pure states as expressed by its effect on 
the the state vectors. This is because application of (2.71) to (2.70) results in the 
SCHRÓDINGER equation (2.72), and, conversely, any solution of the SCHRÓDINGER 
equation for arbitrary initial states | y(to)) yields a solution for U(t,to). The formu- 
lation of the time evolution making use of the time evolution operator U (t, fo) given 
in Postulate 4 has the advantage over the SCHRODINGER equation that it can be 
used for mixed states (see Postulate 5) as well. 

The operator H(t) corresponds to the observable energy of the quantum system. 
Hence, the expectation value (H(r)),, (see Postulate 1) of the Hamiltonian gives 
the expectation value for the energy of the system in the state |y). If H is time- 
independent, that is, H(t) = 0, then the energy of the system is constant and is 
given by the eigenvalues (E;| j € Г} of H. The fact that these eigenvalues are dis- 
crete for certain Hamiltonians is at the heart of the designation ‘quantum’. It was 
PLANCK’s assumption that the energy of a black body can only be integer multiples 
of a fixed quantum of energy, which helped him derive the correct radiation formula. 
But the origins of this assumptions were not understood at the time. Only quantum 


7We remind the reader here once more that in this book we use natural physical units, such that 
h = 1, which is why this constant does not appear as a factor on the left sides of (2.71) and (2.72). 
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mechanics subsequently provided a theoretical and mathematical theory delivering 
a proof for discrete energy levels. 


Exercise 2.18 Let U(t,to) be a time evolution operator satisfying (2.71) for а 
Hamiltonian H(r). 
Show that then 


LU (t4) = —U(t.t0)" Ht) 


U (to,to)" =i: 


(2.73) 


For a solution see Solution 2.18. 


The HAMILTON operator H(t) not only corresponds to the energy observable of the 
system, but also—as is evident from (2.71)— determines the time evolution of the 
system. The specific form of the operator H(f) is determined by the internal and 
external interactions to which the quantum system is exposed. As we shall see in 
Chap. 5, circuits in quantum computers are built up from elementary gates that act 
as unitary operators V on the states. In order to implement such gates one then tries 
to create HAMILTON operators that generate a time evolution U (t,o) implementing 
the desired gate, that is, one attempts to find H(t) and г such that V = U (t, to). 

That time evolution acts as a linear transformation on the space of states is a 
result of the superposition principle. That it ought to be unitary results from the 
requirement to preserve the norm (see Exercise 2.7) of the time-evolved state, which 
in turn is a requirement originating from the probability interpretation (see (2.61)). 

As an example of other observables of eminent importance for quantum comput- 
ing we consider the internal angular momentum of an electron, its so-called spin. 
It consists of three observables 5,,,, S, which are grouped together in the inter- 
nal angular momentum vector S = (Sy, $у, $,). Since we are only interested in the 
spin and not in the position or momentum of the electron, the HILBERT space we 
need to consider is two-dimensional Н = CÊ. The operators on this two-dimensional 
HILBERT space for the spin observable S are? 


1 
S;— 39i for j € {x,y,z}, 


where the o; are the so-called PAULI matrices defined as follows. 


Definition 2.21 The matrices o; € Mat(2 x 2, C) indexed by either j € 
{1,2,3} or j € {x,y,z} and defined as 


5In non-natural units ñ would appear as a factor on the right side. 
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uu (Ol s {Oi ЕЕЕ 
On 2= (о = И T Oy := 02 := [ Ju О O35 — eS (2.74) 


are called PAULI matrices. With оо :— (10) denoting the 2 x 2 unit matrix 
we define the enlarged set 


{са | є {0,...,3}} = {оу, 01,02, оз} (2.75) 
by using the extended notation with Greek subscripts. 
For a two-dimensional HILBERT space H with a designated ONB we also 
use the symbols 


O=1, X=0=0, Y=0=0, 2=03 =0;, 


to denote the operators in (Н) that have the corresponding matrix in the 
designated ONB. 


Exercise 2.19 For j,k,l € {1,2,3} let =; denote the completely anti-symmetric 
tensor with 


£103 = £231 = £312 = 1 £513 £132 2321 
and £j; = 0 otherwise. Verify the following properties of the PAULI matrices: 
(i) 
Oj Ox = 1 + i€ jx} (2.76) 
(п) The commutation relations 
[0,01] = Oj OK — 0,0; = 2i€ x17 (2.77) 
(iii) The anti-commutation relations 


{0,0} = O jOk + OkOj = 2651 


(av) 


* * 
oj =o; and 0j;oj—l, 
that is, the с; are self-adjoint and unitary. 


For a solution see Solution 2.19. 
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Malos). Hanc (4) ол) 


1 


1 
Sel 12) = 51 12) $412) = —zl la), 


For the states 


one finds 


that is, S; has the eigenvalues {+4} with the eigenvectors {| 12),| |z)}, which 
are known as the up, resp. down state for the spin in the z-direction. The 5; аге 
physical observables which can be measured in a STERN-GERLACH experiment. 
For simplicity we shall, however, use 0;—25; as observables in order to avoid the 
unwieldy factor І. 

The reason to denote the eigenvectors | 12) and | |2) Бу |0) and |1) in (2.78) 
is the identification of these states with the classical bit values 0 and 1. Denoting 
the eigenvectors of o; by |0) and |1) has become standard in quantum computing 
and we shall use this notation henceforth. We note already here that a|0) + b|1) with 
la + |b|? = 1 is a possible state (more about this in Sect. 2.4). In contrast, a classical 
bit-value a0 + b1 is meaningless. To avoid misunderstandings, note that |0) is not 
the null-vector in HILBERT space. The null-vector in HILBERT space is denoted by 
the same symbol 0, which we use throughout for the null in sets like No, fields like 
R and C and vector spaces like H. 

The observable o; thus has the eigenvalues +1 and the eigenvectors |0) = | 12) 
and |1) = | |2) as well as the expectation values 


(02) = (010210) = (010) = +1, (о) = (1 


О; 


1) = - (1) = -1. 


As an illustration we show that in the state |0) indeed the uncertainty vanishes. First, 


one has 
1 0 10 0 0 
9:— (631 = t °) Е (0 i) = (0 >) 


(o (5. — (02) 9,1) 10) = (1 0) f | (o -0, 


and thus 


which implies 


Similarly, one shows that Д) (0;) = 0, which follows from the general theory, since 
[0) and |1) are eigenstates of o; and therefore the measurement of the observable о; 
does not show any uncertainty. 

On the other hand, o, and o; are incompatible since 


[Ox, 0z], = -—2io, £0, 
(2.77) 
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ЖОО 
Ox — (Ox) o) 1= E 3 
(oio. — (о) 1) 0) = (10) t | (0) = 1. 


This implies that 


and one finds 


Ap (Ox) = 1, (2.79) 


Syr 
(2.65) 


that is, a measurement of o; in the state |0) cannot be sharp. Similarly, one shows 
Aj (0x)—1. Consequently, о; and o, can never be measured in the same state 
with vanishing uncertainty. The same holds true for o; and o, as well as the pair 
оу and оу. 


Exercise 2.20 Find the eigenvalues and normalized eigenstates | 1%) and 
as a linear combination of |0) and |1), and calculate the probabilities |(Ts 
101 |0)|? to measure the eigenvalues of c; in the state |0) = | 12). 


|) of Ox 
0)? and 


For a solution see Solution 2.20. 


The following example provides a simple illustration of the diagonal form (2.38) of 
an operator and the projector onto a state. 


Example 2.22 As an illustration of its diagonal form o; can be expressed with the 
help of its eigenvectors and eigenvalues: 


o. = (+1)[0(0|+(—1)1)(1| = i) (10) - D (01) 
= (00) - (03) = (8.5) 


For |y) = ao|0) + a1|1) € H with |ao|? + [а> = 1 we find for the orthogonal pro- 
jection 


ANE 
Py = tvi = a (a; ат) — [BL 2 | 


Similar to Example 2.22, Exercise 2.21 provides a further illustration of the diagonal 
form (2.38) of an operator. 
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Exercise 2.21 Verify the diagonal form of 
оу = AjlejYte;l, 
J 


that is, with the results of Exercise 2.20 calculate the right side of this equation. 


For a solution see Solution 2.21. 


We can use the results of the previous exercises to illustrate the content of the Pro- 
jection Postulate as follows. Let an electron be prepared in a state |0) and a mea- 
surement of Oy be performed on it. From Exercise 2.20 we know that the value +1 
or —1 will be observed, each with a probability of 1, Those electrons for which 4-1 
has been measured then constitute an ensemble, which is described by the eigenstate 
| tz) of o, for the eigenvalue +1. The selection after the measurement of only those 
electrons for which +1 has been observed is akin to a preparation of the state | 15). 


2.3.2 Mixed States 


Pure states, however, are not the most general form in which quantum systems can 
appear. Quantum systems can also exist in so-called mixed states, which include 
pure states as a special case. 

Loosely speaking, a quantum particle needs to be described by a mixed state if it 
is in one of a set of states (|y;) }, in other words, its statistics is to be described by 
one of the |y), but we do not know by which one. АП we know is the probability p; 
with which it is in one of the states | y;). The statistical properties of the ensemble 
of particles thus produced are described by a mixed state. 

This is to be distinguished from the system being in the pure state |y) = 
X; Pily), in which case the quantum statistics is described by |y) and not by 
one of the | y;) alone as in the case of a mixed state. 

The mathematically all-encompassing description of quantum mechanical sys- 
tems covering pure and mixed states is given by so-called density operators. 


Postulate 5 (Mixed States) In general a quantum mechanical system is 
described mathematically by an operator p acting on a HILBERT space H 
with p having the properties: 


(i) p is self-adjoint 
=p: (2.80) 
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(ü) p is positive 
р >0. (2.81) 


(üi) p has trace 1 
(te) = Le (2.82) 


The operator p is called density operator and we denote the set of density 
operators on a HILBERT space H by D(H), that is, 


D(H) := (p € L(H)| p*=p, p 20, tr(p) = 1}. (2.83) 


The quantum states described by density operators in D(H) are called mixed 
States. 


In general, the sum of two density operators is no longer a density operator, but 
the set of density operators—and hence mixed states—is convex? in ЦІН), as is to 
be shown in Exercise 2.22. 


Exercise 2.22 Let Н be a HILBERT space and p; € D(H) with i € {1,2}. Show that 
then for any u € [0,1] CR 


up; + (1—u)p2 € D(H). 


For a solution see Solution 2.22. 


For any U є U(H) transformations of the type р — UpU* on any mixed state 
described by a density operator p produce again a mixed state described by the 
density operator UpU*. This claim is to be shown in Exercise 2.23. 


Exercise 2.23 Let H be a HILBERT space and U € (Н). Show that then 


pceD(H = UpU*cD(H). (2.84) 


For a solution see Solution 2.23. 


ЭА set K of a linear space is called convex if for every two elements x, y Є K their connecting line 
is in К as well, that is, if x, y Є K implies (ux - (1 — u)y| u € [0,1]} CK. 
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This result is used in the generalization of the postulates to mixed states. 


Postulate 6 For mixed states the Postulates 1—4 are generalized as follows: 


Postulate 1 (Observables and States) The quantum mechanical expecta- 
tion value of an observable A in a mixed state p is given by 


(A), := tr (pA). (2.85) 


Postulate 2 (Measurement Probability) Zfthe quantum system is in a state 
р, A is an eigenvalue of A and P, the projection onto the eigenspace of À, 
then the probability P (À) that a measurement of A yields the value À is 
given by 

P(A) = (рр). (2.86) 


Postulate 3 (Projection Postulate) Zf the quantum system is initially 
described by the state p, and then the measurement of the observable A 
yields the eigenvalue À of A, then this measurement has effected the fol- 
lowing change of state 


. State before measurement PpP, — state after Q.87) 
measurement tr(pP,) | measurement ; 


where Pj is the projection onto the eigenspace of А. 
Postulate 4 (Time Evolution) Any time evolution of a quantum system that 
is not caused by a measurement is described as an evolution of states 


no measurement 
—À 


p (to) = state at time to p (t) = state at time t 


given by a unitary time evolution operator U (t,t9) acting on the density 
operator as 
p(t) = U(t,to)p(to)U (t,to)" . (2.88) 


Here, as in the case of pure states, the time evolution operator U(t,to) is a 
solution of the initial value problem (2.71). 


The uncertainty is given analogously to (2.65) as 


Ap(A) = T (4- (A), )). 


Pure states |y) € H are given by special density operators of the form 


py :=|W)(W| = Py. (2.89) 
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Note that, deviating slightly from the definition given above, some authors 
reserve the term 'mixed state' for the truly non-pure states. Here we shall use the 
term in the general sense defined above, which includes pure states as a special 
case, and refer to truly non-pure states as ‘true mixtures’. The fact that the general- 
izations given in Postulate 6 in the case of a pure state p = |y} (y| coincide with the 
Postulates 1-4 given earlier for pure states is to be shown as Exercise 2.24. 


Exercise 2.24 Verify that the generalizations for the expectation value, measure- 
ment probability, projection onto the state after measurement and time evolution 
given in Postulate 6 for the case py = |y) (y| coincide with the statements made for 
a pure state |y) in the Postulates 1—4. 


For a solution see Solution 2.24. 


The reason that in general states can be described by positive, self-adjoint operators 
with trace 1 lies in the theorem of GLEASON [52], which we will touch upon here 
briefly. Since a measurement of an observable always yields an eigenvalue of the 
corresponding operator, we can interpret the observable corresponding to orthogonal 
projections (P* — P — P?) as a yes-no measurement. This is because orthogonal 
projections only have the eigenvalues 0 and 1. A mathematical description of such 
systems should then provide a map 


P : (Projections onto H} — [0,1] 
P > Р(Р) (220) 
in which we want to interpret P(P) as the probability to measure the value 1, and 
which should also have the following properties: 


P(0)=0 
Р(1) =1 (2.91) 
PiP, = 0 = Р(Р + P) = P(P,)) - P(P)). 


The properties (2.90)-(2.91) are basic requirements for a probability function P for 
quantum mechanical systems. The following theorem of GLEASON, which we state 
her without proof, then tells us that the set of self-adjoint, positive operators with 
trace 1 is sufficient to construct above mentioned probability function. 


Theorem 2.23 (GLEASON [52]) For a HILBERT space Н with 3 < dim H < 
œ any map P with the properties (2.90)-(2.91) can be represented with the 
help of a positive, self-adjoint operator p with tr (р) = 1 such that P is given 
by 

P(P) = tr(pP) . 
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With suitable modifications this statement is also valid if dimH = ee and thus 
applies to quantum mechanics in general. 
The following theorem provides some additional properties of density operators. 


'Theorem 2.24 A density operator p on a HILBERT space H has the follow- 
ing properties: 


(i) There exist ру € IR with j € I C N that satisfy 


pj 20 (2.92) 
х1 (2.93) 


jel 


and an ONB (|w;j) | j € I) in Н such that 


р = Y рлу) (у => р;Ру, (2.94) 
JEI jet 
(ii) 
0<р2<р (2.95) 
(iii) 
По € 1. (2.96) 


Proof We first show (2.94). Since p as a density operator is per definition self- 
adjoint, its eigenvalues are real and there exists an ONB {|y;)} in which p has the 
diagonal form (2.94). Another defining property of p is its positivity, which implies 
for every vector |) of the ONB 


0 € (wilpwi) => рубу) (|) = pi; (2.97) 


j 
-ój 


proving (2.92). Lastly, we have, again per definition, also tr(p) — 1 and thus 


(2.57) ! 


= È бур) = уур, 
i,j i 


1 = (р) = Èile m = > pily) (Waly) 
LJ 


which implies (2.93). 
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The positivity of p? follows from the fact that for any |y) € H 


2 EE * _ _ 2 
(wip^ v), — (p vipv), = (pvipv), = Дем >0. 
(2.30) (2.80) (2.5) 


The p; in (2.94) are such that 0 < p; < 1 = Y; pj, hence p < pj. One then has 


2 
р (улу) = Y рур) (viwotw = Ур) (УД 0.98) 
j jk —— j 


бк 
and thus for any |y) € H 
(vi(p-ph)w) =, (vlX(i-rplw)tvilv) = Lei - PD) Уу) wily) 
(2.94),(2.98) j j 
2 
a Eei- il 2 0, (2.99) 
Q.1) J 50 50 


that is, p — p? > 0, which proves (2.95). From this it follows in turn that 


lleyll? = PYY zA vy wipe? y) € (vipv) 
Q.5) (2.80) 200) 30) (2.99 
< 
.& Ivilllpwil 
(2.16) 
which implies 
IP vil <1 
ly] 


and thus, because of Definition 2.12 of the operator norm, we obtain (2.96). 


The representation (2.94) of a density operator p given in Theorem 2.24 allows 
us to view particles described by a mixed state as a statistical ensemble of particles 
constructed as follows. Suppose we have a device that, when a switch is set to j, 
produces a particle in the state |y;). Moreover, suppose we have a random number 
generator that produces the switch setting j with probability p;. We then run the 
random number generator many a times and each time use its output j to set the 
switch of the device generating a particle in the state |w;). The statistics of the 
ensemble of particles thus produced is described by the density operator p. We shall 
see in Proposition 2.26 that if p is a true mixture, the statistics of this ensemble 
cannot be described by a pure state. 
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Exercise 2.25 Let {|w;)| j € I) be an ONB in a HILBERT space Н and for j € / let 
€ [0, 1] be such that Y jez p; = 1. Show that then with 


у) = У pw). р= Уруу) (№31 (2.100) 
jel 


jad 


we have for any A Є Bs,(H) 


(А) у= (А), + X VPiPE(WiIAVE) 


jkel;jzk 


For a solution see Solution 2.25. 


In a mixed state p = >  p;|w;)(y;| the probability that a measurement of an observ- 
able A = Y; Ае) (е yields an eigenvalue A; corresponding to the eigenstate |e;) is 
given by 


(Pei) = ,tr(plei) (eil) Z Èr: (еки) (лег) (еек) = Хр) (ез) , 


(2.86) am 57) kd бу 


where Р, denotes the orthogonal projection onto the state |e;). 

One advantage of the description of pure states with the help of a density operator 
(2.89) is that it becomes obvious that the physical information, that is, the state, does 
not depend on the overall phase of the state vector since for any œ € R 


Peiay = je" v) (e^ v], — еи) (ије = py. 
(2.26) 


For the probability to measure an eigenvalue A; of A = У, |e;)A;(e;| one then finds 


(Pei) oy = € (PyPe;) = tr (|) (ylei) tel), — Eley) (ler (еек) 


(елу)? (2.101) 


and for the expectation value 


ay ec tru) = tr(|w)(v|A), = edv) (vlei) leiler) 
Q. Pat 


Sy ШЕ 
(2. t 


s 


exactly as stated in (2.62) for pure states. 
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Whether a given density operator p is a true mixture or a pure state can be decided 
with the help of the following proposition. 


Proposition 2.25 A density operator p describes a pure state if and only if 
p? = р, that is, for a density operator p the following equivalence holds 


dw)eH:p-|w(v| € р=р?. (2.102) 


Proof We first show =: From the left side in (2.102) it necessarily follows that 
||| = 1 since, per definition tr (p) = 1, and thus 


1=tr(p) =tr(/y)(y)) ZÈ ely? = wir. 
ai dip 


From p = |y) (y| with ||w|| = 1 it follows immediately that 


= |w)tviv)(v| = |) (| = 


Now for «=: From (2.94) in Theorem 2.24 we know that there exists an ONB (|wj) 
and real-valued p; such that p = Y; p;|w;j) (1. Because of p? = p one has for all 
k thus 


= (ир? — P) Ve) = (wd; = pj)lv;) (vilwi) = pk — Pr- 
——— 
E 
Consequently, the p; can take only the values 0 or 1, and it follows that 


p= У, iwi. 


Jj pj7l 
Calculating tr(p) = 1 in the ONB {|y;)}, we find 


1= (р) = (wl У, и) (ии) = У, 1. 


і Лру=1 Лру=1 
-ój 


Hence, p; = 1 for exactly one j and p; = 0 for all i Z j. Finally, with |y) = Iv) 
then p = |y) (y| has the claimed form. 
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Density operators that satisfy p? < p thus describe true mixtures, in other words, 
the statistics of such preparations cannot be described by a pure state. We formalize 
this in the following proposition. 


Proposition 2.26 Let p be a density operator on a HILBERT space Н. Then 
the following equivalence holds 


pp «€ |у) ЄН such that for every A € Bsa(H) : (A), = ae 


Proof We actually show the contrapositive 


р^=р €  3|w) € H such that for every A € B(H) : (А), = (A), - 
(2.103) 


First, we show => in (2.103). Let p? = p and {|e;)} be an ONB in H. From (2.102) 
we know that then there exists а |y} € H such that p = |y} (y|, where 


и) = È lelle). (2.104) 


(211) J 


It then follows that for any A € Bsa(H) 


(A), = tr(pA) = t (ly) (WIA) = È (e;ly) (ylAe;) 


ws 
(2.85) (2.57) 7 
= (МАУ (елц)еј) = (Ауу) 
1 (2.104) 
uv. 
(2.60) 


Next, we show « in (2.103). For this let 


pe > Pir inlei) (| (2.105) 


Лә? 


be a given density operator and suppose |y) = Y; v;|e;) € H is such that for all 
A € B,,(H) 
(A), = Ay- (2.106) 


For the left side of (2.106) we have 
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(А), Z tr(pA), = (еу|рАе)) c еј bs Pirinleiy) (Cj lAe ji) 


(2.85) (2.57) J (2.105) / л? 
S È Рл Lileslen)Ani= È Parni (2.107) 
(2.22) sA i= Е. ЛәЛ. 


JA 


Whereas for the right side of (2.106) we find 


Ay cu QM) = Qr р 
(2.60) с 104) 2 
= È Vrv lelen) = È Vavidnn- (2-108) 
(2.4),(2.6) 71-2 Q.22) 2 


Using (2.107) and (2.108) in (2.106) and the fact that (2.106) is assumed to hold 
for all A € Bsa(H), shows that the matrix elements of p must be of the form р ith = 
Wj, Yj, and thus 

P =, У, Vi Vilei)enl = 13) (01. 


Q.105) 7172 


From (2.102) we know that this is equivalent to p? — p and this completes the proof 
of (2.103). 


Proposition 2.26 states that if there is a pure state which can replicate the statistics 
of p for all observables then p itself has to be the density operator of a pure state and 
vice-versa. Consequently, if p is a true mixture, no pure state is able to reproduce 
all the expectation values of p. 

Density operators contain all measurable information about the described sys- 
tem. The diagonal representation of a density operator given in (2.94) in terms 
of its eigenvalues and eigenvectors is unique up to basis changes in degenerate 
eigenspaces. However, other not necessary diagonal representations are possible as 
the following proposition shows. 


Proposition 2.27 Let H be a finite-dimensional HILBERT space and p € 
D(H) be a density operator with diagonal form 


р = > pilv (wil, (2.109) 
j=l 


where the р; €]0,1] for j € {1,...,n} with n € dimH are the non-zero 
eigenvalues of p and {|yj) | j€{I1,...,dimH}} is an ONB of its eigenvec- 
tors. Moreover, for i € {1,...,m} with m < дтн let qi €]0,1] be such that 
У!" 19: = 1 and |ф) € H such that ||ф;|| = 1. Then we have the following 
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equivalence 


m > п and there is aU € U(m) such that 


У ilo) = $, олум 2.111 
p-Yalee| (2.110) ? маф) х Pili) (2.111) 
El 


forie {1,...,т}. 


Proof To begin with, we note that the definition (2.83) of D(H) implies that for p € 

D(H) we have p = p* and p > 0. It follows that p has real, non-negative eigenvalues 

rj, its eigenvectors (|w;)) form an ONB and it can be written as given in (2.109). 
We prove => first. Let |ф;) be such that 


p = Yaile)(ol. Q.112) 
i-l 
Since the |y;) are vectors of an ONB, and thus linearly independent, we have for 


the image p TH} of p 


n = dimSpan { |) | i € {1,...,л}} = dim p {H}. 
(2.27) 


On the other hand, p{H} C Span(|gi) | i € {1,...,m}} such that 
dimp(H) < dimSpan (19) | i € {1,...,т}} < m, 


and it follows that n < m. By assumption, the eigenvectors of p for the eigenvalue 0 
are given by |), where k € {n+ 1,...,dimH}. They satisfy 


m 


0= = i |, 
(нр) =, У, qi | (vel @)| 
(2.112) 20 20 


which implies (y;|@;) = О for all k € {n+1,...,dimH} and i € {1,...,m}. Since 
the {|y;)} are an ONB of H, therefore 
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ІФ) Е. bi (yelo: We) = > (vide) 1м). (2.113) 
nm 


Next, we define the matrix V € Mat(m x n, C) b 


уу = | E wile) (2.114) 
Р] 


fori € {1,...,m} and j € (1,..., n], such that 
n n 
У МУР =, È Valve) Му) S vale) - (2.115) 
j=l 2.114) 71 (2.113) 


We proceed to show that we can extend V € Мат хл, С) to a U € U(m). For this 
we first note that 


Vi = Vi =, (буф), =, | (фу) (2.116) 


and thus for j,k € (1,...,n] 


1 1 


УУУ, = | ji; = | 
A situs VP Уа ЕЕ - s; loo 
1 рі и 
m VER tvi prit ии) = У Dp ” 


Hence, we have specified V € Мат x n, C), where n < m, such that V*V = 1 € 
Mat(n x n, C). This means that the n column vectors of V viewed as vectors in C" 
are mutually orthogonal and normalized to 1. Applying the standard orthogonaliza- 
tion procedure, we can thus add m — n more column vectors such that all m column 
vectors of the resulting matrix U € Мат x m, C) form a basis in C", By this pro- 
cedure we extend V to form a matrix U € U(m) such that U;; = Vi; for j € (1,...,n) 
and (2.115) establishes the claim (2.111). 
To prove <, let m > n and U € U(m) such that for i € {1,...,m} 


Vale) = È Us PAW). 
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This implies 


Yale Ф| = Ža (s: Ушур) | (4 XU Окур) ) 


= > v DjPk (5 го) из) Qu] 


= Y ут ((u*u),;) iw) (l= $ пім) Vi) Ps 
jk-l es EN 19) 
ij 


verifying (2.110). 


Note that, while the |@;) in (2.110) are normalized, they are not necessar- 
ily orthogonal. The following Exercise 2.26 serves as an illustration of the non- 
uniqueness of the representation of a density operator. 


Exercise 2.26 In Н 2 C? let p = Y? 4 gi|@;) (@;| be given by 


2 3 
4 = 5; Ф = = апа i91) =| Tx), |@2) = |0). 


Then one has ||@;|| = 1 = ||@2|| and (|) = S Verify that tr(p) = 1, deter- 


mine the eigenvalues рі, p2 and the (orthonormal) eigenvectors |yri), |y) of p. With 
these, give the alternative diagonal form 


p= » Ру) (vil. 
j=l 


and verify that p? — p. 


For a solution see Solution 2.26. 


In a mixture described by p = Y; p;|w;)(v/| the relative phases of the |w;) are not 
physically observable. This is because for o; € R one has 


Lele wj)" у =, Уре!) (ие = УЛУ) (vil =p 


J (2.32),(2.33) 7 


such that the states e!/|y;) generate the same mixture as the |y;). There is no 
interference. Thus, one speaks of incoherent superposition as opposed to coherent 
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superposition in the case of pure states where the relative phases are observable (see 
the discussion about interference preceding Proposition 2.15). 


Exercise 2.27 Show that for |[ф), |у) € H & C? and о € R the density operator 
Po+y generally differs from the density operator P oci y 


For a solution see Solution 2.27. 


Interactions of a quantum system with its environment can change pure states into 
true mixtures. This is called decoherence. One of the most challenging problems in 
the practical implementation of the theory of quantum computing is the avoidance 
of decoherence for sufficiently long times. 

We emphasize here once more that the knowledge of a state p or |y) only allows 
statements about the statistics of the ensemble described by the state. In general it is 
not possible to predict the behavior of single objects of the ensemble with certainty. 
This is how the phrase ‘a particle or object is in the state p (or |y))’ has to be 
understood. 


Exercise 2.28 Calculate the probability to measure the value 4-1 for the observ- 
able o; 


(1) in the state | 15) 
(ii) in the state | |3) 
(iii) in the state 5 ( 
(iv) in the state p = 5 (| 1%) (1% 


For a solution see Solution 2.28. 


2.4 Qubits 


A classical bit is the smallest possible unit of information. The information given by 
this unit consists of the selection of binary alternatives which are usually denoted 
by 0 and 1 or Yes and No or True and False. The classical bit is realized physically 
by assigning the alternatives to two different states of a physical system, such as 
opposite magnetization in a well defined space on a hard disk. 

With the help of quantum mechanics we can represent the binary alternatives by 
two basis vectors in a two-dimensional quantum mechanical state space. Generally, 
however, the quantum mechanical state space of a microscopic object is an infinite- 
dimensional HILBERT space. The physical realization of a two-dimensional state 
space is then mostly accomplished by restricting the preparation to two-dimensional 
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eigenspaces of a suitably chosen observable. Examples of such quantum systems 
and observables with two-dimensional eigenspaces are: 


e Electrons and their spin 
Ignoring the position or momentum of the electron, we only measure their spin 
state and can map the binary alternatives 


— to the vectors 


0 = | 12) and |1) = | |5) 


as ONB, which consists of eigenstates of o; 
— orto the vectors 


1 
IH) := |14) = S512) +1 ls) and I“) = |e) = 5019 711) 


as the ONB, which consists of eigenstates of о; 
— or to the vectors 


1 3 
119 = zz To + il l2)) and Hg = gts 2) * | La)) 


as the ONB, which consists of eigenstates of су. 


e Photons (Light) and their polarization 
For photons with a given direction of propagation the polarization is described 
by a two-dimensional complex vector, the so-called polarization-vector. The state 
space is thus Н 2 C? and we can map the binary alternatives to 


— the vectors 


1 representing 0 representing 
|0) = 1H) = ( ) horizontal and [10 = |У) = ( ) vertical 
polarization polarization 


as ONB, which consists of eigenstates of the operator o; = |H) (H| — |VY(V |; 
the orthogonal projections |H) (H | апа |У) (V | are called horizontal and vertical 
polarizors 

— or to the vectors 


1 1 

— (|Z) + |V and |—)=-—=(|H)-|V 
wee) a pos) 
as ONB, which consists of eigenstates of polarizors |+) (+| and |—)(—]|, which 


are rotated by 45° relative to the horizontal and vertical polarizors, 
— or to the vectors 


+) = 


|R) = z UD +ilV)) and |1) = z (ЇН) +IV)) 


ue 
sl- 


58 2 Basic Notions of Quantum Mechanics 


as ONB, which consists of eigenstates of the so-called left- resp. right-circular 
polarizors. 


For the representation of the classical bit values 0 and 1 with an electron for exam- 
ple, we can prepare it in an eigenstate of о;, such as |0) for O and |1) for 1. If 
we then isolate the electron from any interactions—that is, maintain its state— and 
afterwards measure оу, we know that then the eigenvalue corresponding to the pre- 
pared eigenstate |0} or |1) will be measured. In other words, the electron stores the 
value of the binary alternative 0 or 1. A measurement of o; corresponds to a reading 
of the stored information. 

In order to maintain the stored bit unaltered it is crucial that the electron is not 
disturbed by interactions that could change its state. With information storage in 
a classical computer, such as on a hard disk, this is relatively easily accomplished 
since most external disturbances such as light or heat do not alter the stored bit. 
In that case it suffices to avoid exposing the hard disk to strong magnetic fields. In 
quantum mechanical systems, however, it is far more difficult to isolate the system 
from state-changing interactions with its environment. This is one of the major chal- 
lenges in a realization of quantum computers currently being addressed in numerous 
ways. 

The classical bit can thus be represented by an ONB in a two-dimensional 
HILBERT space. The choice of the ONB is arbitrary, as long as we have a suit- 
able observable which has the two vectors of this ONB as its eigenvectors. Mea- 
surement of this observable then serves as a read-out of the stored bit. As can- 
didates for a physical realization we mentioned above electrons and their spin or 
photons and their polarization. But any other quantum system with a suitable two- 
dimensional subspace may be chosen. Mathematically we can always identify the 
two-dimensional HILBERT space IH with C? by choosing an ONB . 

Quantum mechanics, however, also allows states of the form a|0) + b|1) with 
a,b € C and the normalization |a|? + |b|? = 1 for two-dimensional systems. These 
linear combinations of the states |0) and |1) have no analogue in the world of clas- 
sical bits. They do not occur in classical computing. The information that can be 
stored in a two-dimensional quantum system is thus much greater than what can 
be stored in a classical bit. Writing, reading or transforming such information in a 
quantum system also requires special care. АП this motivates the new notion of a 
qubit, denoting two-dimensional quantum systems with a view towards their infor- 
mation content. 


Definition 2.28 A qubit is a quantum mechanical system described by a two- 
dimensional HILBERT space denoted by ‘H and called qubit space. The infor- 
mation stored in a qubit is contained in the qubit state in ‘HI in which the sys- 
tem is, and it is manipulated and read according to the postulates of quantum 
mechanics. In H we select ап ONB { |0), |1) } and an observable represented 
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by a self-adjoint operator denoted by o; that has the normalized eigenvector 
|0) with eigenvalue +1 and |1) with eigenvalue —1. 


The terminology here is in accordance with that of classical computing: a classi- 
cal bit is the elementary information container and the classical information content 
is given by the bit values (0,1). The elementary information container in quantum 
computing is the two-dimensional quantum system described by “Н. The ‘value’ of 
the quantum information is the state |y} € “Н in which that system is. 

As a consequence of the Projection Postulate 3 we thus have the following 
corollary. 


Corollary 2.29 A measurement of ©; on a qubit yields either +1 or —1 as 
observed value and projects the qubit in the eigenstate |0) or |1) correspond- 
ing to the observed value. 


The orthonormal eigenvectors |0),|1) of o; form a standard basis in "IH, with 
which the qubit-HILBERT space "Н can be identified with C?. From now on we will 
also use these states to represent the classical bit values 0 and 1. This representation 
of classical bit values by the eigenstates of o; is as shown in Table 2.1, and is to be 
understood as follows: a measurement of о; in the qubit state yielding the value +1 
represents the classical bit value 0. The Projection Postulate 3 furthermore tells us 
that then the qubit is in the state |0). Conversely, if we want to represent the classical 
bit value 0 in a qubit, we prepare the state |0). An analogous statement holds for the 
eigenvalue — 1, the eigenvector |1), and the classical bit value 1. 

This way each classical bit value is mapped to a qubit state. However, not every 
qubit state can be mapped to a classical bit value. This is because a general qubit 
state is of the form 

lw) = a[0) +451) (2.117) 


with a,b € C and |a|? + |b|? = 1. In case ab Æ 0, this is a superposition of |0) 
and |1) for which there is no corresponding classical bit value. As we shall see 
later in the presentation of some quantum algorithms in Chap. 6, it is the presence 
of superpositions having no classical equivalents that contributes to the gains in 
efficiency compared to classical algorithms. 


Table 2.1 Representation of classical bits by qubits 


Observed value of o; qubit state Represented classical bit value 
+1 10) =| Ta) 0 
-1 DRIED 1 
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How can we suitably parametrize a pure qubit state of the form (2.117)? Because 
la + |b|? = 1 we can find 0,8,0 € R such that a = e cos? and b = eB sin 9. 
Thus, a qubit state has the general form 


|y) = cos 20) е? sin 211). (2.118) 


Physically equivalent to |y)—and thus representing the same qubit state (see dis- 
cussion around Definition 2.14)—is the following member of its ray 


a+ ав Ө B-a Ө 
e 17 |y) =e cos 70) e 7 sinz |). 


With @ = B — a this leads to 


9 0 i$... 0 e iF cos 6 
[v(0,0)) :=e '2cos = |0) Fe? sinz|l) = | ^. 2|. (2.119) 
2 2 е!2 sin 8 
An observable that has this state as an eigenstate can be constructed as follows. For 
aj 
a vector a= | a» | € R? one defines the 2 x 2 matrix 
d3 


3 " 
16i 00 ( ©з: A 9) (2.120) 


= àj--la? —a3 


The notation а. с introduced in (2.120) is standard in physics. Confusion with the 
normal scalar product а b for a,b € R” can be avoided by keeping in mind that 
whenever the second factor is o then the expression denotes the 2 x 2 matrix given 
by (2.120). 


Exercise 2.29 Show that for a,b c IR? 
(а.с) (b.c) =(a-b)1+i(axb)-o, (2.121) 


where a: b = Xia ajb; € Ris the usual scalar product and 


a2b3 — aab» 
axb- | abı -aib | c R? 
арэ — arb, 


is the usual vector (or cross) product. 


For a solution see Solution 2.29. 
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With the unit vector 


sin Ө cos @ 
й = (0,0) :— | sin@sing | c R? (2.122) 
cos Ө 
it follows that T 
. . [([ cos0 esin 
й-о= Є КК ) А (2.123) 


This is the operator for the observable spin in direction fi, and one has 


—1ф us EL ө 
109.0) -о1и(0,0) = („ўы e ae ( i) 


eif sin@ —cos0 el? gin 8 


T : : 
= & (cos Ө cos 8 er) 


‚Фф v s 
ei? (sin @ cos $ — cos 0 sin $ 


u e-i? cos 8 
ei? sin? 
= [v(0.9)). (2.124) 


The state | (0, $)) is thus the spin-up-state | Та) for spin in the direction й: 


еті cos $ 
| Та) = TAE (2.125) 
e'? sin5 
Analogously, one finds for 
1%. ө 
—e !? sins 
| la) :— | 19 3 (2.126) 
e'2 cos 5 
then 
ñ- o| 1a) =—| la)- 


In particular, it follows from (2.123) and (2.119) that 
£(0,0).0 —0; and |Тоо) =| Ta) 


or 
(nt 
a(5,0) 0-0, and |Тилоу) = | Tx). 
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The state |w(0,$)) = | Та) parametrized by 0,6 thus represents an arbitrary qubit 
state, and the operator fi- с represents the observable that has this qubit state as an 
eigenstate with eigenvalue 4-1. 
How can we then parametrize mixtures of qubits? For this consider the complex 
2 x 2 matrix of a density operator 
| (ab 
m) 


Since p* = p, it follows that a,d € R and b = c, and since tr(p) = 1, that a+ 
d = 1. Hence, we can write a and d with the help of a real number хз in the form 
а= 155 and d = Lg. Moreover, introducing the real numbers x, = 2Re (c) and 
x2 = 2Im(c), and making use of (2.120) we can thus write an arbitrary qubit-density 
operator in the form 


df 01x xix m. | 
e-5( ) )- 5 (1+x о). (2.127) 


Exercise 2.30 Let px be given as in (2.127). Show that then 
xj=tr(pyo;) for je (12,3), 
which can be succinctly written as x = tr(po). 


For a solution see Solution 2.30. 


So far we have only used p* = p and tr(p) = 1 from the defining properties of a 
density operator. A further defining requirement is that it has to be positive, that is, 
it has to satisfy p > 0. We know from (2.97) that the positivity of p is equivalent to 
the requirement that all eigenvalues of p be non-negative. The eigenvalues q1,q» of 
px are found from (2.127) as 


1+ |х 1+ |х| 
= => 2.12 
йз=——у 5 (2.128) 


such that the requirement p > 0 is satisfied only for |x| < 1. Thus we have shown: 
the density operators for mixtures of qubits can be parametrized by vectors x in the 
closed unit ball Bis of А. This parametrization is called the BLOCH representa- 
tion and shown in Fig. 2.1. From the fact that every x € В represents a mixed state 
we can see graphically that mixed states form a convex set, as was already shown in 
Exercise 2.22. Moreover, the edge points |x| — 1 correspond exactly to pure states, 
as can be seen as follows. With the help of (2.121) and (2.128) we obtain 
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Fig. 2.1 Representing qubits with the BLOCH representation. The boundary sphere Shs of pure 
states is called the BLOCH sphere. Note that whereas the whole of the closed ball Bis (including 
its interior as mixed states) represents all possible states of a qubit, the only two classical bit values 


correspond to the north and south pole. The circles o show the representatives of the pure states 
|12), Tp). | Т). 12) and | Тас,ф))- The black dots e show the mixed states P_ig= i є 3 and 


at the center ро = 11 


р2 = (nexo) = a (10 +x?) eme) 


such that o2 — px if and only if |x| — 1, and as shown in Proposition 2.25, the 
property p? — p is equivalent to p describing a pure state. 

From Exercise 2.22 we know already that density operators—and hence mixed 
states—form a convex set. A particular property of two-dimensional systems, and 
thus qubits, is the fact that all edge points correspond to pure states. If the quantum 
system is described by states in a HILBERT space with dimension larger than two, 
only certain edge points correspond to pure states. 


2.5 Operators on Qubits 


By Definition 2.28 qubits are two-dimensional quantum mechanical systems 
described by vectors in a two-dimensional HILBERT space "HH. With the exception 
of measurements, their time evolution is described by unitary operators. Thus, apart 
from measurements, all transformations we wish to apply to a qubit have to be 
unitary as well. This also applies to the action of elementary components of qubit 
circuits (so-called quantum gates), which we shall discuss extensively in Sect. 5.2. 
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In the following we thus present a number of results relating to the construction of 
unitary operators on "Н, which will be particularly helpful in the context of afore- 
mentioned quantum gates. We begin with a general result about exponentials of 
certain operators in Exercise 2.31. 


Exercise 2.31 Let A be an operator on a vector space satisfying A? — 1. Show that 
then for any œ € R 


pue Y Go)” аз =cosa1+isinaA. (2.129) 
n—0 п. 


For a solution see Solution 2.31. 


Throughout this book we will use both notations e^ — exp(A) to denote the expo- 


nential function of an operator A, the choice being made depending on which of the 
two provides more transparent expressions. 

The following Definition 2.30 is motivated by the theory of representations of the 
group SO(3), that is, the norm- and orientation-preserving linear maps of R? (see 
Example F.8). 


Definition 2.30 Let ñ є 51, be a unit vector іп IR? and æ € R. The action of a 
rotation around the vector n by the angle œ on the qubit space "IH (also called 
spin rotation) is defined as the operator 


Tors 
DROES CE EE 
The spin-rotation D&(«) is an operator on Н. It is the action in the qubit 


space that represents the action of a rotation in the position space IR? around fi by 
the angle o. 


Lemma 2.31 Let fi € BL, and œ € R. Then one has 


Da(a) = cos 21 —isin 58-0 (2.130) 


a a 
Dala)" = Da(—a) = cos 1+isin5a-o (2.131) 
Рһ(а)ра(0)* = 1, 


that is, а (а) is a unitary operator оп Н. 
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Proof From (2.121) and because of fi- fi = 1 it follows that (fi. c) = 1. With 
this (2.130) follows immediately from the result (2.129) in Exercise 2.31. 
From (—1й. 0)* = iñ- 0 and (2.130) we obtain then (2.131). Finally, one has 


[04 [04 [04 
Da(o)Dg(o)* = cos —1-— isin 58:0) (cos 51 +isin =й. с) 
(2.130),(2.131) 
2 07 Q 
= (cos 71) — (isin сао) = (cos? L 4+ sin? ) 1 
2 2 
1. 


The result Da(o)Dg(—0) = 1 has a generalization, as is to be shown in Exer- 
cise 2.32. 


Exercise 2.32 Show that for any ñ € S}, and o, B € R 


Da(0)Da(B) = Dala +P). (2.132) 


For a solution see Solution 2.32. 


Before we show in Exercise 2.33 that every unitary operator on “Н can be con- 
structed by multiplication of suitably chosen spin-rotations Da(-) and a phase-factor 
e'*. it is helpful to prove the following Lemma 2.32 as an intermediate step. 


Lemma 2.32 Let U be a unitary operator on ЇН. Then there are о, D ,6, y ER 
such that the matrix of U in the standard basis (|0), |1) } is given by 


s E oe gh 

— Ale PE 2 

Ul =e {8—6 oy ¡B+ y a (2.133) 
ez sink e'7 cost 


Proof Let the matrix of U in the standard basis {|0),|1)} be given by 


ab 
U= | A (2.134) 


. [аё 
U*= (ў 5) (2.135) 


with a,b,c,d € C. Because of 
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and UU* — 1, it follows that 


la? -- |b? = 1 = Je? + |a}? (2.136) 
ac 4- bd = 0. (2.137) 


If c = 0, then |d| = 1 follows necessarily, which implies b = 0 and thus |a| = 1 as 
well. In this case U is of the form 


ei 0 
U = | A) : (2.138) 


and with a = 11 В = т] —6 and 6 = y= 0 can thus be written іп the form (2.133). 
Similarly, it follows in the case а = 0 that U is of the form 


0 io 
U = (s p ) (2.139) 


and with о = огіл = 0 +л- тара В = 0,у = л can be written in the 
form (2.133). 
Now let ac 52 0. Then 


d 
а= —b— 
С 
2 
2 2 14| 
> jJw-b-— 
|с 
ар c? +4]? b|? 
= ТАУ ТЕ [14 T | = _ e, 
Ic] I" 14 
(2.136) 
which implies 
|b] - |c| and |а| = |4]. (2.140) 
Hence, there are 6,1], y € R such that 
a = её cos Un d = e" cos Us (2.141) 
2 2 
from which in turn it follows that 
2 _ E n owe ES ux 
[|5 = | — 1—|а| = sin y (2.142) 


(2.140) (2.136) 


Thus, there are 9, t € R such that 
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b=-e@siny, с=евјһ?. (2.143) 
2 2 
Because of ac = —bd +Æ 0, we have 
еі) sin 7 соз 1 = e(07) sin Усов 1 (2.144) 
and thus é — т = 0 — N + 267. We choose n = 0 + t — 6 such that 
eS cost  —el?sinI 
= (s sinZ ei(9-* 1-5) cog Į : P 
With the change of variables 
oT 
з= > ‚ Brst-€, б:=@—ё (2.146) 
we obtain in (2.145) 
— go — b8 = a + PB 
б=а FR ier s (2.147) 
т=0@+=5—, o+t—é = a+ 7; 


that is, U has the form claimed in (2.133). 


With the help of Lemma 2.32 it can be shown that any unitary operator on qubits 
can be expressed as a product of suitable spin-rotations around the 2- and $-axis. 


Exercise 2.33 Let U be a unitary operator on “Н. Show that there exist a, D, 6, y € 
IR such that | 
U = e* D4(B)Ds (Y) D4(8) . 


For a solution see Solution 2.33. 


A consequence of the claim shown in Exercise 2.33 is that a device which can exe- 
cute spin-rotations around the Z- and $-axis would be sufficient to implement any 
unitary transformation of qubits. 


Example 2.33 One has, for example, 


e? 2,(0)0%(0)0(0) =? (cos 21 -isin 52 : c) 
= еї? (cos £1. іѕіп о ) 
2 2T 
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e. cos $ — isin $ 0 
0 cos $ + isin 5 


1 0 
= б às) | (2.148) 
ог 
" 8+3) соѕ 2 еї? sin Z 
1 5 . » Al 2 сна 
е'20,(В)05(л)0,(В +7) = еї? p e -i5 sin mou 
_ (01 
~ A10 
= бу, (2.149) 
or else 
е # D4(0)Dg (5 )Dal л) = = я isin то ies 1—1 Za) 
= “(51 59%) = s -ig,6.) 
V2 WY 
—10y 
atoa (2.150) 


Inverses of spin-rotations around the 2- and $-axis can be obtained by left- and right- 
multiplication with Oy. 


Exercise 2.34 Show that 


oxDs(n)ox = Ds(—) 


2.151 
o,D;(n)ox = D;(—n). n 


For a solution see Solution 2.34. 


The claim in the following Lemma 2.34 plays an important role in connection with 
quantum gates, which we shall consider in more depth in Sect. 5.2. 


Lemma 2.34 For every unitary operator U on Н there exist operators A,B 
and C on H and a € R such that 


ABC =1 
U = e'“Ao,Bo,C. 
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Proof From Exercise 2.33 we know that there exist œ, D, y, Ó € R such that 


U = e*D,(B)Ds (y) D4(6). (2.152) 
We thus set 
A := D;(B)Ds (2) 
в:= D; ( 2) o ( £) (2.153) 


Then it follows that 


ax s bron Gapa 5) (55) 


(2.153) 
D,(- 338.558 \—p,(-8) 


and 


= е'*р;(В)р» (2) суру ( 1) Di ( x) оу» (255) 


(2.153) 
=1 
= «во, (Dos (-2) b (-25* ) ом» (35) 
e* D,(B)Dy (3) суру (=>) Ox 0xD; (-5£) Ox D2 (255) 
Sa Se 
=D;(3) =,(52) 
= eD4(B)Dy (2) Ds (2) р; (252) (22) 
(2.151) EET cS == 
5 *0(8)0()р:(5) 
02.132) 
О. 
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Indeed, for every unitary operator U on ЎН we can always find a suitable unit 
vector fi € Shs and angles &,6 € R such that U can be written as a product of a 


phase factor е!“ and a spin-rotation with angle 6 around fi. This is shown in the 
following Lemma 2.35. 


Lemma 2.35 Let U be a unitary operator оп H. Then there exist 0,6 € R 
апай є 51. such that 


U = e*DQ(E). 


Proof From Lemma 2.32 we know that there exist œ, D, 0, y € R such that in the 
standard basis {|0),|1)} the matrix of U is given by 


ET y {5—8 Y 

ре | * Z соѕу —e 2 m 
i ex 109 ê sin? ex ee cos 7 
Ply р 2 


— о (cos #+8 isin 23) cos (cos © TM ча (2.154) 
(cos 29. + isin B®) sin} (cos 279 +isin 22? 


= git (cos E22 cos h 


ô б— б— 
1 sin B+ cos Yo, + cos sin Zo + sin 


2 2° 2 
We now find 0 and @ in 
sin Ө cos @ 


fi —f(0,0) = | ѕіпӨѕіпф |, 
cos 0 


and ё such that e ^U = Dao,o)(6)- For this we first choose a E such that 


cos = COS ар COS =. (2.155) 


Then we have 
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We choose ё = É if sin and sin 7 have the same sign апа ё = E. otherwise. Then 
there exist Ө € [0,5] and 0 = 7 — Ө; € [5, 7] such that 


sin6jsin$ = sin, JE {1,2}. 


With this choice of Ё then (2.155) holds for € as well, and so far we have altogether 


ô 
cos — cos +P cos? (2.156) 
sin;sin = sin? (2.157) 
From (2.157) it follows that 
о т жш, 
(1 — cos^ Ө;) sin = cos 2, 
апа this in turn implies 
cos? 0j sin 2 = cos? T esi 2 1 = cos? 7 cos? : 
6+ p y 
— 2 2 
= (1 cos 2 ) cos 2 
(2.156) 
ô 
= sin ы cos? 1 
Thus, we have 
ô 
созбу | = |sin <P cost 


РЕ : +B 7. 
If sin 3 and sin —5.€085 


that in every case 


have the same sign, we set Ө = Ө, otherwise Ө = 05, such 


ô 
cosÓsin = sin TP ost 
We now set @ :— В-8ё+л such that 
sind = dr с. — oe: 
2 2 
scq E. "dn ig 
2 2 2 


Altogether, we thus have in (2.155) 
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+6 
cos — cos = cos? 
" las у_. 6 DUX 
sin —,— 605; = sin, cos0 = sin ^fi, 
soe жы sin 88 sin © sinO sing = sin Š a, 
2 2 2 2." 
ô— 
sin p sin NE dnt sin Ө cos 9 = sin Ea, 
2 2 2 2 


and finally 
5 


е 190 = cos 51-145 


= Рра(б). 


Lemma 2.35 implies that апу U € (ЎН) can be expressed as a linear combination 
of the unit matrix and the PAULI matrices as is to be shown in the following exercise. 


Exercise 2.35 Show that every A € ЦН) can be written in the form 


3 
А=1-+7.О = у габа , 
о=0 
where zo € С апа z € C?, and in the last equation we used the notation (2.75) with 
O0 = 1. 
Moreover, show that if A € (Н) then the zy have to satisfy 


Io + |a = 1. 


For a solution see Solution 2.35. 


From Lemma 2.35 it also follows as a corollary that every unitary operator U on H 
has an—albeit not necessarily unique—root. 


Corollary 2.36 Every U € UH) has a root, that is, there exists an operator 
VU € UH) such that 


(vu) =u. 
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Proof From Lemma 2.35 we know that there exist à, ó € R апай € SL, such that 
U= e^ Da(£) А 


With this we choose 


From Lemma 2.31 we know that Da (5) € U(‘H), and since еї € Ц(ЎН), it follows 
that VU € U(‘H) as well. Moreover, we find 


(vu) = ef p, (5) et D, G) = меб =й, 


Example 2.37 Consider, for example, 


ei? р(х) -i(cosZ 1 isinZ&.c) zd = оү (2.158) 
such that 
л 1 
va = ё#0,(2) = PC 1—isin ко) 
(2.130) 
1+i/ 1 1 1+1 
= 1—1—о,|= 1—1оу 
Fe (gta) =F anie) 


and one verifies 


1 E 2 1 2i :2 2i 

IC ЖЕ ы cete TT Nous 4? qj Cacus. 

2 4 7 4 
-1 


On the other hand, we also have 
1-i ? 1-24 -2i 
(> а+чоо) = рдо 42 o2)- ——(2їоү) = оу. 
2 Ww 4 


4 
=1 


Another widely used operator on "Н is the HADAMARD transformation, which is 
also known as the WALSH-HADAMARD transformation. 


74 2 Basic Notions of Quantum Mechanics 


Definition 2.38 The HADAMARD transformation is defined as 


_ Ox + OZ 


© ЧН = а 
у 


А few useful properties of ће HADAMARD transformation are collected in the 
following lemma. 


Lemma 2.39 In the basis (|0),|1) } the HADAMARD transformation has the 


matrix | T 
Н = == | E) (2.159) 
and satisfies 
(0) + |1) 
= p 
H0) = —55 (2.160) 
|0) — [1) 
[у наны 2.161 
H|1) T (2.161) 
0) - el 
H|xj) = тте (2.162) 
Н? —1, (2.163) 
as well as PA. т 
Н = еї#р,(0)ру (5) D,(—2). (2.164) 


Proof The claim (2.159) follows immediately from the Definition 2.38 of H and 
the PAULI matrices in (2.74). This implies (2.160) and (2.161), and because of x; € 
(0,1) these in turn imply (2.162). Equation (2.163) is easily verified by taking the 
square of the matrix in (2.159). 

The representation (2.164) of the HADAMARD transformation by a multiplication 
of a phase-factor and a spin-rotation was already shown in (2.150). 


2.6 Further Reading 


For the reader who would like to get more background on functional analysis in 
general and HILBERT spaces in particular a good entry level exposition can be 
found in the book by RYNNE and YOUNGSON [53]. The book by KREYSZIG [54] 
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introduces the reader to the most important elements of functional analysis at the 
same level. More advanced is the first tome in the series by REED and SIMON [50], 
which also contains extensive chapters on topological and convex spaces as well as 
unbounded operators. An excellent reference way beyond functional analysis and 
HILBERT spaces is the book by CHOQUET-BRUHAT and DEWITT-MORETTE [55]. 
This collects a lot of material in mathematical physics and presents it in a concise, 
yet rigorous, fashion, albeit most without proofs. 

As for quantum mechanics, there are, of course, a great number of books. The two 
volumes by GALINDO and PASCUAL [37] contain sufficient mathematical rigor and 
cover a great breadth of topics. Similarly modern in style and broad in coverage of 
topics is the two-volume set by COHEN-TANNOUDJI, DIU and LALOE [39]. Neither 
of them, however, specializes in quantum computing. Rather, both present quantum 
mechanics from its historical origins and postulates through to the myriad of special 
topics, such as the hydrogen atom, symmetry transformations, angular momentum, 
perturbation theory, etc. 


Chapter 3 A) 
Tensor Products and Composite Systems get 


3.1 Towards Qbytes 


Classically, information is represented by finite chunks of bits—such as bytes— 
and multiples thereof. These are essentially words (хі, xo, xa, . . . , Xn) built from the 
alphabet (0, 1) > х, where! € (1,..., n}. Hence, we need 2" classical storage con- 
figurations in order to represent all such words. 

A classical two-bit word (x;,x2) is an element of the set {0,1} x {0,1} = 
10, 1)2, and classically we can represent the words 00, 01, 10, 11 by storing the 
first letter ху (the first bit) and the second letter x2 (the second bit) accordingly. If 
we represent each of these bits quantum mechanically by qubits, we are dealing with 
a two-qubit quantum system composed of two quantum mechanical sub-systems. 

Many quantum mechanical systems are composed of several parts, each of which 
is again a quantum mechanical system. The hydrogen atom, for example, consists 
of a proton and an electron. Let the states of the proton be given by elements of a 
HILBERT space Н? and those of the electron by HE. What, then, is the HILBERT 
space of the hydrogen atom? The answer is: the tensor product Н? @ НЕ of the 
HILBERT spaces of the sub-systems.! The tensor product H^ @ HP of two HILBERT 
spaces НА and IH? is again а HILBERT space and provides the state-space for the 
quantum mechanical description of the total system composed of the sub-systems 
H^ and HP. Before we turn our attention to multi-qubit systems, we shall thus first 
review tensor products of HILBERT spaces. 


I Quite often the proton is viewed as an object (fixed at a place in space), which exerts a COULOMB 
force on the electron. In this approximation the state of the proton remains unchanged and one con- 
siders only the effects on the electron such that HË suffices for the description of the total system. 
A more precise description includes the reaction of the electron on the proton and uses center- 
of-gravity and relative coordinates. For isolated systems the center of gravity changes trivially (in 
other words, maintains constant velocity), and the corresponding HILBERT space is then ignored 
in this description as well. 


© Springer Nature Switzerland AG 2019 T] 
W. Scherer, Mathematics of Quantum Computing, 
https://doi.org/10.1007/978-3-030-12358-1.3 
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3.2 Tensor Products of HILBERT Spaces 


3.2.1 Definition 


Here we give a more informal definition of the tensor product of two finite- 
dimensional HILBERT spaces. This is sufficient for our purposes. For a strict and 
generally valid version that includes the infinite-dimensional case the reader is 
referred to [50]. More important than the most general definition, however, it is 
for us here that we can give the calculation-rules for tensor products, such as for 
the calculation of the scalar product, with the help of the known rules for the sub- 
systems. 

Let H^ and Н? be HILBERT spaces, |~) € H^ апа |y) € IH? vectors in these, 
and define 

Ie) 2 |у): H^ x HË — С 


(£m — (Eg) (luy? ` PM 


This map is anti-linear in & and r] and continuous. Define the set of all such maps 
and denote it by 


H^ @ H? := (Ww : H^ x HË — C | anti-linear and continuous] . (3.2) 


This is a vector space over C since for 4,% c H^ @ HË and a,b € C the map 
defined by 


(aH + P) (Е, m) = а (é, n) + PAG, m) (3.3) 


is also in H^ & HË. The null-map is the null-vector, and — У is the additive-inverse 
vector for Y. According to (3.1) then |ф) & |y) is a vector in the vector space of the 
anti-linear and continuous maps НА & HË from H^ x Н to C as defined in (3.2). 


Exercise 3.36 Let |o) € H^ and |y) € H? and a, b € C. Verify the following iden- 
tities. 


(a|9)) & ly) = lẹ) 8 (a|v)) = а(|ф) & |v)) 
а(|ф) & |w)) + b(|9) & |w)) = (a+ b) lp) & |y) 
(lpi) + 12) ® ly) = 1e) ® |у) + 1e) & |) 
Ie) ® (vi) +w) = lp) 8 lyi) +l) ® |). 


For a solution see Solution 3.36. 


In order to simplify the notation we shall also write 


lp & v) := |p) 8 |y). 
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For vectors |) Q |) € H^ & IH? with k € {1,2} and |o) € H^, |у) € HË we 
define 


(фі ® [фо & vo) :— (ф|ф›) (vi | uo)" , (3.4) 


where in the following we shall often omit the superscripts, which indicate in which 
HILBERT space the scalar product is to be calculated. With (3.4) we have a scalar 
product for vectors of the form |ф) @ |y) in НА @ HP. In order to define a scalar 
product for all У € H^ & Н? we consider ONBs in the subspaces. Let (|e;)) C НА 
be an ONB іп НА and {|f,)} C HË be an ONB in HP. The set (|e;) ®|/Ь)} C 
H^ & HË is then orthonormal since 


(ea, ® fo, lea; ® foa) = (ел, lea) (fo | fb, ) = 2125 Ob, by - (3.5) 


(3.4) (2.10) 


Considering an arbitrary vector V/ € НА @ HP, one has for this anti-linear map 


v5.0) = (Y lea) e£). E I) iim) 
= È Y (lea); 15) (Elea) (nfo) 
a,b м1 


=: PEC 


= È Pv (lea) ® |fo)) (1) 
a,b 

= Y Fablea D Toe. n). 
a,b 


This proves that every vector |) € H^ @ НЗ can be written as a linear combination 
of the form? 


\Р) = У Eolea e fo) : (3.6) 
a,b 


Exercise 3.37 Let {|e,)} C H^ and {|f,)} C HË be ONBs. Show that the set 
[lea & fp)} is linearly independent in H^ @ Н. 


For a solution see Solution 3.37. 


The scalar product of |”) in (3.6) and a vector 


|Ф) = Y Palea & fo) 
a,b 


?With possibly an infinite number of terms in the infinite-dimensional case. 
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is then defined with (3.5) as 


= ab Bab - (3.7) 


The scalar product thus defined on all of НА @ Н is positive-definite and indepen- 
dent of the choice of the ONBs, as is to be shown in Exercise 3.38. 


Exercise 3.38 Show that (Ҹ|Ф) as defined in (3.7) is positive-definite and does not 
depend on the choice of the ONBs {|e,)} C H^ and {|f,)} C Н. 


For a solution see Solution 3.38. 


The bra-vector belonging to |”) in (3.6) is then 


(Ф| = У Чу (е fo (3.8) 
a,b 


and acts as in (3.7) on a |Ó) € H^ & HP. 
The norm of |У) € НА @ HI is calculated as 


IPI = (PIP) = S. (3.9) 
ал) ® 


and for any |p) € Н^ and |y) € Н? we have 


lle & wil, = v (e & vie e v), = v (ele) (viv), = liell. (3.10) 
(2.5) (3.4) (2.5) 


Hence, H^ Ф HË is a complex vector space with scalar product (3.7), which induces 
а norm (3.9). For finite-dimensional subspaces then H4 @ Н is complete in this 
norm and thus according to Definition 2.1 a HILBERT space.? For our purposes it 
suffices to view H^ c Н? as the set of linear combinations of the form (3.6) with 
Dab LE < co and the calculation rules (3.7) and (3.9). 


3Only in the case of infinite-dimensional subspaces the space H4 @ Н? needs to be completed in 
this norm (see [50]) for it to become a HILBERT space. 
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Definition 3.1 The HILBERT space H^ c IH? with the scalar product (3.7) is 
called the tensor product of the HILBERT spaces H4 and Н. 


Proposition 3.2 Let (|e;)) C H^ be an ONB in H^ and (|f;)) СН” be an 
ONB in HP. The set (|ea & f»)) = (|ea) ® | fo) } forms an ONB in H^ @ HP, 
and for finite-dimensional H^ and HP? one has 


dim (ви @ H^) = dim H^ dim E? , 


Proof From Exercise 3.37 we know that the set {еа & fp) } is linearly independent 
and from (3.6) that every |Ҹ) € H^ @ IH? can be written as a linear combination of 
vectors from this set. Orthonormality of this set follows from (3.5). 

The statement about dimensionality follows immediately from counting the ele- 
ments in the set. 


For several tensor products, such as НА @ H? @ НС, associativity holds 
(n^ e n^) ән = m^ ә (n^ o HC) = n^ en? o H° 
and, accordingly, 


(P1 8 wi 8 x19» & vo ® x») = (119) (i| Wo) Qa) - 


Likewise, with the ONBs (]e;)) C H^, {|f,)} C Нё and {|g.)} C НС one has 


|У) Є ^ & HË @ НС = |У) ES у Чаьс|ёа Q fo ® gc) 


a,b,c 


with the Pye € C such that Xa p,e Fabel” < co. 

Recall that in the case dim H = n < © we identified a given basis {|e;)} C H 
in (2.23) with the standard basis in C”. As shown in (2.26) this then allowed us 
to express any vector in H with the help of the standard basis in C”. How does 
such a construction look like in a tensor product H^ @ Н? with dim НХ = ny < ee 
where X € (A, B) and ONBs {|е„)} C H^ and (|f;)) C IH? For this we assume 
that the isomorphisms НХ 2 C"x with X € (A, B) are established by (2.23). We 
then establish the isomorphism НА & HË = C"4"£ by identifying the basis {|e4 & 
fo)} C H^ & HP with the standard basis іп C"4"? as follows: 
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1 1 1 
2 0 1 
lae fi) = : |, laef-: of, a, 
nang NO nang NO 
1 0 
: 1 0 
: 0 2 0 
lea fo) = (а—1)пв+Ь|1]|,_..., eedem >|, 61D 
; 0 : 
š NANB 1 
NANB 0 


where the columns to the left of the parenthesis show the row numbers for illustra- 
tion and are not to be considered part of the equations. As in (2.23) and (2.24) the 
representation of (e; & fp| in С”А”В is the transpose of the right side of (3.11). Note 
that our way of arranging the isomorphism means that we are essentially dividing 
the nang rows of a vector in C”4”8 into n4 row-blocks of ng rows. In other words, 
the first ng vectors of the standard basis іп C"4"5 are identified with 


еә fi), |е D Р),...,|е® №). 


The next ng vectors of the standard basis in С”А”В are identified with 


lez & fi), |е D f2),....le2 №) 


and so on until the last ng vectors of the standard basis in C”4”8 are identified with 


len, 8 Л), Jeng Р), raeg len, ® fug) : 


For a general vector |Ҹ) € НА @ Н? we thus have 


1 V 


nA np ү 


9) = Y, У Males @ fo) = (а—1)пв+Ь| Po 
a=1 b=1 А $ 


NANB Pia np 
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Example 3.3 Consider the case НА = H? = "Н & C? with the ONBs 


{le} = (03 = (9. = ((5) (2) ] - 


where the rightmost set denotes the standard basis in C?. For H4 & HË 2 C^ we 
then have the ONB 


{lea & fo) } = 1100), [01), |10), |11)} = ‚ (3.12) 


ооо н 
ста 
ARRA 
оо © 


where the rightmost set denotes the standard basis in C^. Moreover, for j € {1,2} 
let aj, b; € C and 


ө) аю +) = (2). |e) = ald) etn = (2) 
Then we have 


фі) @ |@2) = (a0) + bif1)) & (a2|0) + b2|1)) 
=  aja5|0) ® |0) + ay b2|0) ® |1) + b1a2]1) & |0) + by b2|1) @ |1) 
= а1а|00) + a1b5|01) + bia2|10) + bib2|11) 
aiaz 
aıb2 


AE G.13) 


(3.12) bib; 


With a further НС = “Н & C? with the ONB 


09) = qo. = (0) (1)] 


we then find for H^ @ H? @ НС = C8 the ONB 


{lea & fo & ва)} = 11000), 001), 010), |011), |100), |101), |110), |111)} 
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ооооооо н 
ртр 
CEPR 
C Ue REIS 
=» 
оонооооо 
он с фос со со ос 
= OO OC Oo осе, 


where the last set now denotes the standard basis in C8. Also, let a3,b3 € C and 
|з) = a3|0) + b3|1). 
Then we have 


|ф1) & |@2) & |фз) = (а1|0) + b1|1)) & (az|0) + b2|1)) & (a3|0) + b3|1)) 
= ауазаз|000) + a1a5b3|001) + аурзаз|010) + a1b5b3|011) 
-Fb1aaa3|100) + b1aob3|101) + b1b2a3|110) + bıb2b3|111) 
414243 
aiab3 
a1b5a3 
a1b5ba 
b1a2a3 
byanb3 
bi b2a3 
bi bob; 


Concerning the tensor product of bra-vectors, note that because of 


(Qi ® vil (Ie) ® )) = (ewe @ о) = (91/92) (уи о), (3.14) 
(3.4) 


we can also write 


(9 8 y| = (e| @ (yl. (3.15) 


Example 3.4 Consider again the case НА = HI? = 1H & C? with the dual* ONBs 


{(eal} = {fol} = (01, 01) = {(1 9), (0 1)} , 


^These are actually basis { (ua|}, {(vp|} of the dual spaces (ШНА )*, (HP)* satisfying (ил|еи) = ôa a' 
and (vp| fp) = бьь. But as remarked before, we can identify (H^)* with H^ and (IHP)* with IH? 


and thus (иа), (ОЪ) = (еа), Co. 
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where the last set denotes the standard basis in the dual space (C2)* & C?. For 
HA & Н = C^ we then obtain the ONB 


{(ea & fol} = {(00|, (01, (10], (11]} 
= {(1000),(0100),(0010),(0001)}, (3.16) 


where the last set denotes the standard basis in the dual space (C^)* 2 C^. More- 
over, for j € (1,2) let cj, d; € C and 


(үл = 01+ (01 (ed). (|= ex0| + at] = (c2 Ф). 
In the basis {|e, & fp) } we then have for the matrix of 


(i| & (| = (e1(0| + di (1]) ә (e(0| + (1) 
= с1с2(0| & (0| + cid2(0| & (1| + dyes (1| & (0| + did (1| @ (1| 
= c1e2(00| + c1d5(01| + dic2(10| + dido (1| 


== (cic с1йә› дус? didz) Р (3.17) 
(3.4) 


Using the standard basis of “Н to build basis of higher tensor powers ‘H®” of “Н 
as in the Examples 3.3 and 3.4 can be generalized and leads to a natural one-to-one 
correspondence between these basis vectors in 1H®” and natural numbers less than 
2”. This is what the computational basis, covered in the next section, is about. 


3.2.2 Computational Basis 


Definition 3.5 The n-fold tensor product of qubit spaces is defined as 


H” = Н ®.--®НШ. 
ee 


n factors 


We denote the j + 1-th factor space counting from the right in ‘H®" by “Н. 
In other words, we define 


j+1-th factor 
c 
H” =H, 19-9 Н; @---@"Ho. (3.18) 


The HILBERT space ‘H®” is 2"-dimensional. The reason to count the factor 
spaces from the right will become evident further below when we define the very 
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useful computational basis. Every number x € No with x « 2" can be expressed in 


the form 
п—1 


х= У х2)  withxj Є {0,1}, 
j=0 


which results in the usual binary representation 

(x) Basis 2 = Xn-1 . + -X1X02 with xj€ (0, 1) Я (3.19) 
For example, 5 = 1015. АП possible combinations of xo,...,x,-; thus yield all 
integers from 0 to 2" — 1. Conversely, every natural number x less than 2" corre- 


sponds uniquely to an n-tuple xo, . . . ,Xn-1 € (0, 1)" and thus to a vector |x, 1) & 
e @ lxi? G9 [xo) c He”. 


Definition 3.6 Let x € No with x < 2" and xo,...,x, 1 € (0,1)" be the 
coefficients of the binary representation 


п—1 | 
pem У „Л 
j=0 


of x. For each such x we define a vector |х) € 19%" as 


bi 2 9) 2 til оосо) 
0 
к a1) a= 100) |) - (3.20) 
j=n-1 


If it is clear in which product space ‘HI®” the vector |х)" lies, we will also 
simply write |x) instead of |x)”. 


Note that in (3.20) in accordance with the usual binary representation (3.19), the 
counting of indices in |x) = |x,_1 .. . x1xo) starts from the right. We also express this 
by the bounds on the index j in 9.4: The way in which the |х) in Definition 3.6 
are defined explains the counting of the factor spaces in (3.18). This is because with 
[xj) ЄН; for j € (0,...,n — 1}, one then has 


j+1-th factor 


~ 
HS” — "Н, 19... 9 ‘H; @---@‘Ho- (3.21) 


> |1) 8 Q xj) Q- ® |х) 


For the smallest and largest in “Н®" representable numbers 0 and 2" — 1 we have 
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п—1 

|2" — 1)" = |11...1) = |) e *g" (3.22) 
j=0 
п—1 

10)" = |00...0) = Q |0) є \Н®”. (3.23) 
j=0 


Since the factors in the tensor products in (3.22) and (3.23) are all equal, the 
sequence of indexing does not matter in these special cases. 


Lemma 3.7 The set of vectors (|x) € *IH?" | x € No, x < 2") forms an ONB 
in "IH", 


Proof For |х), |y) € ЇН?” one has 


(ly) = Gi e - Xo|yn-1 s - yo) 
n—1 А 
l іх; = уу Vj 
siewi ehe ' ' 
(3.4) = 
= бу. (3.24) 


Hence, the {|x) | x € No and x < 2") form a set of 2" = dim Н®” orthonormal vec- 
tors in *IH?", As the number of orthonormal vectors in this set is equal to the dimen- 
sion of *IH?", the set constitutes an ONB in this HILBERT space. 


The ONB іп *IH*?" defined by the numbers x € No with x < 2" is very useful and 
thus has its own name. 


Definition 3.8 The ONB ір *IH?" defined for x € {0, 1,...,2" — 1} by |x) = 
|хл—1...Җ0) is called computational basis. 


Example 3.9 In *Н the computational basis is identical with the standard basis: 


wp-o-(). е 


where the rightmost equalities show the identification with the standard basis in 
C? = "Н. The four basis vectors of the computational basis іп ‘H®? S C^ are 


88 3 Tensor Products and Composite Systems 


1 
0)? = |00) = |0) & |0) = н 

0 
1)? = |01) = |0) &|1) = : (3.25) 
2)? = |10 = |) ® |0) = : 

0 
3)? = |11) = |) 8 |1) = : 

1 


1 
0 
0 

(0° = |000) = 0) & 0) & 0) = |0 
0 
0 
0 

1)? = |001) = 

2)? = |010) 

3)? = |011) 

4)? = |100) 

5)3 = |101) 

6)? = |110) 

7)? = |111). 


For example, in “Н we may consider 


le = СЫР - A (t) 


192) = s = “3 €) 
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With these one finds in SH®2 


1 f1 1 1 1|-1 
eee) lm ele) = 7 (1) e s (1) = 1 
(vi & w| = (y| (|= (10) ә (0 1) 


where the rightmost vectors are now expressed in the basis given in (3.25) and its 
dual. Using this, we find that in this basis the matrix of |ф & Ф) (yi ® yo| is given 
by 


1 0 100 
M = 1[0-100 
Il $e) ew|-5| (0100) = 03 08 (3.26) 
=] (2.27) 0-100 
On the other hand, we have 
1/1 1 f10 
eotwl - 7 (1) @0 =, (10) 
(2.27) 
Lyi ИТ (3.27) 
ext = (1) (01) = a): 
(2.27) 


The fact that the vectors of the computational basis are identifiable by numbers in 
No makes this basis play an important role in many areas of quantum computing, 
such as quantum gates (see Chap. 5) or algorithms (see Sects. 6.5 and 6.9). 

The computational basis consists of so-called separable (or product-) states (see 
Definition 4.1). They are called this way because in each of these states of the com- 
posite system the sub-systems are in pure states as well. For example, in the state 
101) of the computational basis (3.25) of the composite system "IH? the first sub- 
system is in the pure state |0). An observer of this sub-system, who measures О; 
in his sub-system, will always observe the value +1. At the same time, the second 
sub-system is in the pure state |1), in other words, an observer of the second sub- 
system, who measures o; in his sub-system, will always observe the value —1. But 
the four-dimensional space “H8? also admits other ONBs. One such basis is the 
BELL basis. 


Definition 3.10 The BELL basis in the four-dimensional space “Н? con- 
sists of the basis vectors 
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$*):— (100) +111 
| E л pee mp. (3.28) 
[ =» 101) + |10) 


Exercise 3.39 Show that the BELL basis is orthonormal. 


For a solution see Solution 3.39. 


As we shall see later, the BELL basis does not consist of separable, but entangled 
states (see Definition 4.1). From (3.55) and the results of Exercise 3.44 it even fol- 
lows that the BELL basis vectors are maximally entangled (see Definition 4.4). 

As the remark after (3.55) shows, this implies that in the pure state | *) є *IH?? 
of the composite system the first sub-system is not in a pure state, but in a true 
mixture. This can perhaps be formulated as: a qubit-word (= a state in "H^? = 
‘H © Н) in general does not consist of pure qubit letters (= pure states in 1H). We 
shall look at this in much more detail in Sect. 3.3. 


3.3 States and Observables for Composite Systems 


Quantum systems, which may be described as separate systems with their respective 
HILBERT spaces, can—and sometimes have to—be combined to form a larger com- 
posite system. Although heuristic arguments for the construction of the HILBERT 
space of such composite systems from those of the sub-systems can be given, there 
does not seem to be a rigorous derivation, and this construction is best given in 
‘axiomatic’ fashion in the form of another postulate. 


Postulate 7 (Composite Systems) The HILBERT space of a composite sys- 
tem that consists of the sub-systems H^ and HP is the tensor product 
H^ @ HP. 


It follows from Postulate 5 that the states of the composite system are thus gen- 
erally represented by density operators p on H4 @ HË. As shown in Theorem 2.24, 
these can be written in the form 


p = > mE 


jel 


where the (|V)| j € Г} are an ONB in НА & H? and the p; € (0, 1] satisfy 
Xjerpj = 1. 
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Combining first two systems НА and Н? to a composite system with HILBERT 
space H^ & Н, we may then combine this with a third system НС and we see 
that the total composite system of all three sub-systems has the HILBERT space 
H^ & HË @ НС. Continuing in this fashion we see that the HILBERT space of a 
composite system formed of n sub-systems НАЈ, where j € {1,...,n}, is given by 

n.a H^ = НА! 9... H^, 


Example 3.11 We know from Example 2.5 that the HILBERT space for a single 
particle in three-dimensional space is H = I2 (R)). The HILBERT space for the 
composite system formed by n such particles is HI°°™? = [2(R?"), In this case it 
is indeed a mathematical property of L?(IR?"), that 


Нер — L2 (R?7) — (12083))“" =- p”. 


Applying a terminology widely used in quantum computing, we shall always 
assume that system A is controlled (in other words, can be read and operated on) 
by Alice and that system B is controlled by Bob. The association of sub-systems 
with persons is indeed helpful when describing the systems. For example, instead of 
saying ‘an observer of sub-system A observes’ it is simpler to state ‘Alice observes’; 
or instead of saying ‘a state is prepared in sub-system В” it is more concise to state 
simply ‘Bob prepares the state’. 

From observables of the sub-systems we can build observables of the composite 
system.? For example, let МХ : НХ — НХ be self-adjoint operators of observables 
in the respective sub-systems X € {A, B}. We can then form the operator МА & МВ, 
which acts factor-wise on tensor products |9 & y) = |ф) & |y), that is, 


(м^ & M^) lee у) = (м1) & (w^qy)) | (3.29) 
ЄНА ЄНВ 


Using linearity, the operator then acts on an arbitrary vector 


|Ф) = У Dalea) & | fo) c H^ & H? 
a,b 


as follows 


(м & m”) |Ф) = У о» (^l) © (мел) cH gH. (3.30) 


>There are, of course, observables of composite system which cannot be built from those of the 
sub-systems. 
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Example 3.12 As an example we consider the j-th component L; of the total angu- 
lar momentum of a non-relativistic electron, which with j € (1,2,3] constitutes a 
vector-valued observable in R?. It is built from the orbital angular momentum oper- 
ator J; and the intrinsic angular momentum (spin) operator 5; as 


Lj—J;91-c-1G5;. 


The adjoint of a tensor product of operators is the tensor product of the adjoint 
operators as Exercise 3.40 shows. 


Exercise 3.40 Show that for operators M^: H^ — HA, M? : HË — HË and 
M^ & M? : H^ & HË — Н @ IH? one has 


(M^ & м?) = (M^)* ә (м?) (3.31) 
and thus 
(M*)* = МХ for X є {A,B} => (M^ @ м8)* = м^ әм, (3.32) 
that is, the tensor product of self-adjoint operators is self-adjoint. 


For a solution see Solution 3.40. 


Suppose that for X € (A, B} the operators M* : НХ — НХ in the respective basis 
{|ea)} € H^ and (|f;)) € HË have the matrices 


X 
Mx... MX, 
МХ = " á 
X X 
ME ooi MAE 


What is then the matrix of M^ ® M? in the basis [|e; & fp)} € H^ @ HË? To 
answer this, we first note that 


ПА ng 


M^ ® M? = у у ea Q fo) (€a ® fs (M^ ® MP eq ® fo’) (Ca! ® fol 
a,a! —1 b,b'=1 
na пв 
К У у €a® fr) (ва & fo|M e, & M? fy) (eu ® fol 
a,a! —1 b,b/—1 
ПА пв 
= у у Ca & fo) (es| M^ eq) (ІМ fiy) (eu 8 fo'l 
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nA 
= Y У MiMi 9 fo) (ea ® fol. (3.33) 
a,a! —1 b,b/—1 


From (2.25) we infer that 


1 k n 
1 
; | 
МАМ, lea & fo) (еа ® fol = j МА ‚МВ, | 
п 


where now in accordance with (2.25) and (3.11) we have j = (a — 1)ng 4- b and 
К = (а — 1)пв + b', and we have written out the only non-zero matrix element. 


Inserting this into (3.33) we find 


м^ эм? = (3.34) 
1 de ng пв + 1 L3 2пв М nang 
А MB А В А мВ А B А В 
1 My My, vis Mi My, ММ} dis ММ, ve Mi, Ming 
А MB А MB А MB А MB А В 
np ММ МҮ Мап ММ ММ» o Mp Mngng 
А MB А MB А MB А MB А В 
пв +1 Мм e. ММ, ММ M»My, Min, Ming 
А MB А MB А MB А MB А В 
2пв ММ ММ ММ My Mong ud Mn, Mngng 
А В А В А В А В А В 
Nang My Mg rds Mp, 1Mngng ММ NS My, 2Mngng ка, Miana Мпьпв 


A closer inspection of (3.34) reveals that the matrix is comprised of blocks consist- 
ing of the matrix for MP multiplied by matrix elements M^, In other words, the 


matrix of M^ & MP in the basis {|e, & f) } is given by 


B B B B 
мү, os Min, мү, ы Ming 
A Р А A ; : 
Mf i Н UU Min, : : 
B B B B 
My ж Mignp My HD Mrgng 
M^ @ M? = : 
B B B B 
Мү М» Mj MUS 
А $ А 5 
My 1 : : U Mang : 
В В В В 
My TES Mong Magl KES Mrgng 
(3.35) 
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As an example of a tensor product of operators, we show that the projection onto a 
tensor product of states is equal to the tensor product of projections onto the factor 
states. 


Lemma 3.13 For arbitrary |), |92) € H^ and |wi), |y2) € H one has 


фі v1)(9» & y| = |P1)(G2| & |у) (|. (3.36) 


Proof For any |£i), |é2) € H4 and |C1), |62) € HË we have 


(а e&l(leve wi) owl) eG) = (ele ew) e volé @ &) 
=, ien СС) (ale) (volo) 


м 
3.14) 


= (ёи) (esl) и) (volo) 
= (11е) 1м) 6) ® 0). 


м. 
3.14) 


=~ 


a 


Example 3.14 For j € {1,2} let |ф;), |w;) be as in Example 3.9. From (3.26) we 
know that then in the basis (3.25) 


0100 
1|0-100 

lee) owl-5lo19p|: (3.37) 
0—100 


On the other hand, we have in the same basis 
1 /10 1 /0 1 
wale =z (10) 255 (5-1) 
(3.38) 


Together (3.37) and (3.38) verify (3.36) for this particular example. 
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The operator M^ @ MP thus represents an observable of the composite system. As 
an example for the action of an observable in the tensor product ‘Hi? = *TH & ‘H 
of two qubit spaces we show here how M^ & MP = o^ ® of acts on the BELL 
basis (3.28) of the composite system “НАР. 


(e. & о:)|Ф=) = (о: = е) =z (100) + ju) 
1 


= 3; (2-262) (10 8 10) £11) 810) 


1 1 
= 519 elo +11) e inj = (190) + |11)) 
= |o* (3.39) 
Analogously, one shows 
(08 o,)|¥*) = -|¥*) 
(о, & ox) |Ф+) = +/+) (3.40) 


(ава) в) = +). 


In the BELL basis {|Ф7), | ), |У), |W—)} the operators б, ® о; and 0, Q о; 
thus have the matrix (see Definition 2.6) 


100 0 
010 0 

0z G) О BELL-Basis — 00-1 0 
000 -1 
1000 
0—10 0 

Ox ® Orlin BELL-Basis = 0010 ; 
00 0-1 


from which it is evident that these operators commute 


o: 96.0. 8 5. =0, (3.41) 
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Table 3.1 State determination via joint measurement of о; © 0; and Oy ® Ox 


Measured value of State after measurement 
0; ® Oz Ox о 

+1 +1 |+) 

+1 —1 |7) 

—1 +1 ba 

-1 —1 E 


and the corresponding observables are compatible. In particular, they have—as can 
be seen immediately from (3.39)-(3.40)—common eigenvectors, and it is possible 
to measure these two observables sharply, in other words, without uncertainty. The 
combination of the measured values of these observables thus reveals in which state 
the system is after the measurement as shown in Table 3.1. The state determination 
shown in Table 3.1 will play a role again in the context of teleportation. 

Carrying out a measurement on a sub-system—an observable of system A with 
the operator M^, say—is a measurement of an observable of the composite system 
with the operator M^ @ 18. Analogously, measurements on the sub-system В are 
represented by operators of the form 14 @ МВ. Consider, for example, the pure state 
of the composite system 


P) = У Yalea) ® | fo), 


a,b 


in which the observable М^ of the sub-system A is measured. The expectation value 
in this state is calculated in accordance with (2.60) as 


(МА 9 18), = (Ф|М^® I, =, У У Fb Pab (Ca ® fo,|M^ea, ® fo) 
(3.30) 121 42,02 


Ў, > Tob; Фа (еа, |M^ ea, ) Uo, fo) 
— 


a1 bi a,b2 


е 
с —Óp pi 


У, WE (6s M^ ea). (3.42) 


425,0] b 


II 


This is the expectation value of the observable M^, which Alice will find with mea- 
surements on her sub-system. She would find exactly the same expectation value if 
her sub-system alone were in the following state: 


pre) = Y, olea) (ear: (3.43) 


45,0] b 


As we will show below p^ (V) satisfies all defining properties of a density operator. 
Hence, p^ (У) describes a mixed state for the sub-system A, which depends on the 
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composite state |У”). For observables of the form M^ the state p^ (V^) reproduces the 
expectation values of M^ ® 1? in the composite state |У”). We now show that p^ (У) 
has all properties of a density operator, in other words, that р^ (V^) is self-adjoint, 
positive, and has trace 1. First, we have 


(e^t) = YX Wm (lea) eal) = Y, ае) (а 


a1 ,42,b —— a1 ,a2,b 
—|ea5 ) (ea; | 


ep. 


proving that р^ (V^) is self-adjoint. That it is positive follows from 


(elp^(P)o) = Y, ЧЧ ь(ф|ев,)(еа,|Ф) 


a1,a2,b 

= уе ab Ф|еа,) )) (È Yank (@|ea,) )) 

b а 

2 

= у у Fab (Olea) 

b a 
20, 

and its trace property is verified by 
tr (p4(¥)) = У E oo Ua i ees lea.) ( ёа» |еаз) => Ia =, ||| ? 
3,41 ,a2,b mot 


= 1. 


Next, we prove the claimed equality of the expectation values of the states |У) and 
p^ (V) for observables of the sub-system A. From (3.43) it follows that 


(M^) aq, = tr (р^(%#)мА) — У esdp^ (P)M^e;) 


a 


у Bo dus (ea|ea, ) lea |мл еа) == = >} Tob Pablea |M^e,,) 


4,4, a5, b ay ,a2,b 
M А В 
E (м^ @1°), 
(3.42) 


Il 


For Alice all measurements on her sub-system, which is part of a composite system 
in the state |У”), indicate that her system is in the mixed state р^ (V^). This means that 
in a composite system that is in the pure state |У) € НА c IH? and thus described 
by the density operator p = |) (Ф| on H^ @ IH? the sub-system in Н is described 
by the density operator 
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p^(V)- Y, Чъь%дь|ёд)(еа;|. (3.44) 


a] ,d2,b 


Analogously, in the state |) of the composite system the expectation values of 
observables MP for the sub-system B only are given by 


(^6 MP, = Y Va, o lM” foi); 
bi ,b2,a 


and with 


PR = Y Ww ffl (3.45) 
bı ,b2,a 


one has accordingly 
(MP) вр) = a^ әм?) : 


Loosely speaking, the expression for р^ (V^) can be viewed as if the trace over {| fp) } 
has been taken and that for p? (P) as if the trace over {|e,)}. This can indeed be 
more generally and formally defined, but before we do so, we prove a result about 
existence and uniqueness of what will become known as the partial trace. 


Theorem 3.15 Let H^ and Н” be HILBERT spaces with respective ONBs 
{|еа)} and {|fp)}. Moreover, let M € ЦН & НВ) and let Maib, a,b, be 
the matrix of M in the ONB {\ea & fy)} of H^ @ HË and let the operators 
tr? (M) € ЦНА) and tr^ (M) € HP) be given by 


tr? (M) = `X Маь,а ёа) (ёа | 


ajab 


tu^ (M) = ` Mab, aby|fo,) Мы] - 


by bya 


(3.46) 


Then ti? (M) and tr^ (M) as given in (3.46) do not depend on the choice of 
the ONBs 1|e;) ) and {|f,)} and are the unique operators satisfying 


vM^ € I(H^) : tr (M^ t” (M)) = tr ((M^ ә 18)м) 


vM? € (HP): tr (M? u^ (M)) = tr (17 ә M®)M) . (3.47) 


Proof We only prove the result for tr? (M). The proof for tr^ (M) is, of course, 
similar. The proof of the independence of the choice of ONBs is left as an exercise. 
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Exercise 3.41 Show that the operator tr? (M) as given in (3.46) does not depend on 
the choice of the ONBs { ел) } and {| f,)}. 


For a solution see Solution 3.41. 


Next, we verify that tr? (M) as given in (3.46) does indeed satisfy the first equation 
in (3.47). For this let (|e;)) be an ONB in H^, {|f,)} an ONB in H? and M € 
Цна e HP) be given by 


M= b» Mab, аЬ» ёа 8 foi) (ea & fb; . 


a1,a2,b1,b2 
Furthermore, let 


=> МА alea) (еа, | 


ay ,a2 


be an arbitrary operator in LH. Then one finds that 

tr ((M^ & 1°)M) 

2 (ea; @ | (M^ @ 15) 2, lea, e М, aıb1,a2b2 (еа, e fh, |€a3 e foz) 
—1—— 


a3,b a1 ,47,b 1 ,b 
(@5]) 93273 rcd =бауаз Ôbz b3 
= у (ea e) fo, (M^ ea) e) fb, )M. abı ‚а2Ь2 
a1 ,02,b1,b5 
= у (ea |M ea) (foy|.fo,) М, аір. = у Ма a, Мауьазь 
a1 ,02,b1,b5 y аџ,а2,р 
=, 
А 
N = / Mj, t M) as = У (м tr? (M) a 
(3.15) 1,02 B 
= tr(M^u?(M)) , 


(2.57) 


verifying that tr? (M) as given in (3.46) indeed satisfies the first equation in (3.47). 


Lastly, we show uniqueness. Let tr? (M) be another operator on НА, which satis- 
fies the first equation in (3.41). Then for any M^ € цн) one finds 


tr (M4 (ое (м ) - t? (M ))) 


| 


tr (m^re (м)) — tr (M^ tr” (M)) 


= ((M^ &15)M) — tr ((M^ & 15)M) 
( 


and because of (2.59) thus tr? (М (M) = tr? (M). 
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Note that tr? (M) is an operator in цн“). Hence, M^ tr? (M) € ЦІНА) and the 
trace on the left side of the first equation in (3.47) is a Rad number obtained 
from taking the trace on an operator in ЦН“). The trace on the right side of the 
first equation in (3.47) is a complex number obtained from taking the trace on the 
operator (M^ @ 18)М є L(H^ ® НЗ). Theorem 3.15 states that there is a unique 
operator tr? (M) such that for every M^ € L(H^) these two complex numbers coin- 
cide and that this operator is given as in (3.46). Likewise, the theorem makes analo- 
gous statements for tr^ (M). These results of Theorem 3.15 thus allow the following 
definition. 


Definition 3.16 Let H^ and Н? be two HILBERT spaces. The partial trace 
over Н? is defined as the map 


tr : L(H^ & H?) — oe 
M = tr? (M 


where tr? (M) € ЦІНА) is the unique operator that satisfies 
M^ € (H^): tr(M^u? (M)) = tr ((M^ ®1°)м). (3.48) 
Similarly, the partial trace tr over H4 is defined as 


t : L(H^ @ HB) — sale 
M I— tr^ (M 


where tr^ (M) € ЦІН?) is the unique operator that satisfies 


VM? e1(H5): tw(M^w^(M)) = tr((14 ә MP)M). 


The standard terminology ‘partial trace’ has the potential to mislead. This is 
because whereas the trace on operators of a HILBERT space H is defined in Def- 
inition 2.13 as a linear map 

tr: I(H) > С, 


such that evaluating it results in a complex number, the partial trace is a linear map 
t” : (H^ @ H5) > ЦН“), 
and evaluating the partial trace on an operator results in an operator. 


However, taking the trace of a partial trace gives the same number as taking the 
trace of the original operator as is to be shown in Exercise 3.42. 
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Exercise 3.42 Show that for any M € L(H^ & HF ) we have 
tr (tr? (M)) = tr (M) = tr (tr^ (M)) . (3.49) 


For a solution see Solution 3.42. 


With the help of the partial trace we can define from the state p of the composite 
system an operator р^, which has the properties of a density operator and describes 
the state of the sub-system A when observed alone. 


Theorem 3.17 Let p € рни & HË ) be the density operator describing the 
state of a composite system H^ c HP. Then 


pau := t” (p) (3.50) 


is the uniquely determined density operator on H4, which describes the state 
if only the sub-system A is observed. For any observable M^ € B, (H^) it 
satisfies 
А А ы 4B 
(M^) лу = M^ 815), . (3.51) 


Let furthermore (|e;)) be an ONB in НА and (|f;)) an ONB in HË as well 
AS Da, b, ap, be the matrix of p in the ONB {|е & fy) ) in H^ & HP. Then the 
matrix of p^ (p) in the ONB {\eq)} is given by 


aaa = X Mane: (3.52) 
b 


Proof That tr? (p) exists and is unique was shown in Theorem 3.15. There we also 
showed with (3.46) that p^(p) — tr? (p) has the matrix given in (3.52). 

Observation of an observable M^ of the sub-system A of a composite system 
described by states in D(H4 & HË ) is akin to observation of the observable МА & 15 
in the composite system. As a consequence of Definition 3.16 we have that p^(p) = 
tr? (p) satisfies 


(м^ 9 г Z" (м^ e) 15)p) = (м^ tr? (p)) = (М^р^(р)) 
(2.85) (3.48) (3.50) 
АМ") (3.53) 
(2.85) 


verifying (3.51). 
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That p^ is a density operator on H^ follows from the fact that it satisfies all 
defining properties of a density operator as we now show. 


p^ is self-adjoint: to prove this it suffices to show р^(р) а, =p" (psa, їп an 
arbitrary ONB {|e,)} С H^: 


* 


P. sp E 


p 

-— z Урана = Xara с. È рара 
b 

. кы =р 


o 


Ку И 
3.52) 


р^ is positive: let {|/Ь)} be an ONB in HË and |ф) € H^ be arbitrary. Then it 
follows that 


(Pl P) = Y, Tarp (0)aa Pay 


1,025 
— by Qa, уу Payb, arba = у Фа Da, ba; b Pay 
(3.52) ay ,a2 a1 ,a2,b 


= $ (03 HIPS fr) 
b =n 


>0 since p>0 


p^ has trace 1: 
tr (p^ (p)) = S p^ (Paz 
2 у 2 Pab,ab = t (p) 


52) © 
1. 


=~ 
ә 


Ww 
(2.82) 


This shows that р^ is a density operator on НА and thus it describes a state in 
the sub-system A. Observing only the sub-system A of a composite system means 
measuring only observables of the form M^ & 1? in the composite system. Because 
of (3.53) the expectation values of such observables in the composite state р are 
identical to the expectation values of M^ in the state p^. Consequently, o^ is the 
state that describes the physical situation when observations are restricted to the 
sub-system A. 
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Regarding the notation, note that р^ (р) is the state, which describes the physics 


if one only observes sub-system A. It is obtained from the state р of the composite 
system by taking the partial trace over the sub-system B, that is, p4(p) = tr? (p). 


Definition 3.18 For a density operator р on H^ @ HË the reduced density 
operator оп H^ is defined as 


p^ (p) := t” (p) 


and the reduced density operator on IH? as 


Example 3.19 As an example with qubit spaces we determine p“(®*) for the 
BELL basis vector 


1 1 1 
Ф*) = — (100) + |11)) = = |0) ® |0) + 1) ®[1). 3.54 
at) = T(J) +1) = 75 090) Tien). 350 
=Фу, -9j 
Then we obtain 
р^(Ф*) = 71 Ф ьФь\ёа,)\ёа›| 
(3.44) а1,а2 b 
= ССЖ ЕЕ $0 ) еа, ) (ёа, | 
1,025 
1 1 
= —|1)(1 
500 + 5001 
(3.54) 
lA 
= jl : (3.55) 


2 
Since (p^) = 11^ < 11^ = p4(@*), Alice indeed observes a true mixture 


in her sub-system even though the composite system is in a pure state | *). 


Corollary 3.20 Similarly, we have for a state of the composite system given 
by the density operator p € рни @ HF), that the sub-system іп HË is 
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described by the reduced density operator 
p”(p) = t“ (p) - (3.56) 
For all observables M? one then has 
(м? о at & M^), 
where now the state pP(p) — tr^ (p) in B is obtained by calculating the par- 


tial trace over A of the state p of the composite system. Accordingly, we have 
for the matrix elements 


ping У Pab; ab, - 


Proof 'The proof is very much the same as that for Theorem 3.17. 


Exercise 3.43 For X € {A,B} let МХ є L(H*). Show that then M^ & M^ € 
L(H^ e HP) satisfies 


tr? (M^ & M?) = tr (MP) м^ (3.57) 


For a solution see Solution 3.43. 


As an example for reduced density operators we compute those arising from consid- 
ering one sub-system when the composite two-qubit system is in one of the BELL 
basis states. 


Exercise 3.44 Determine р^(Ф-), p^ (PF), pP (^) and pP (V) for the vectors 
|Ф=), |=) of the BELL basis (3.28). 


For a solution see Solution 3.44. 


From Postulate 7 it follows that a system comprised of n qubits is described by the 
HILBERT space "IH". In general any observable of such a system or its operator 
thus acts on n qubits. As Exercise 3.45 shows, any such operator can be expressed 
as a suitable linear combination of n-fold tensor products of operators on one qubit. 
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Exercise 3.45 Let V be a finite-dimensional vector space over a field IF. Show that 
then for any n € N 
Ly) = YV)”. (3.58) 


For a solution see Solution 3.45. 


Note that (3.58) does not mean that every A € I(V?") is of the form A = А! 9 
:: © А, for some Aj,...,An € ЦУ). Rather, it means that every A € ЦУ“) is of 
the form 


А= Хар. Aj 8: BAR, 
J 


for some а j, € F and Aj,,..., Aj, € ЦУ). 
A special notion has been reserved for operators which can be written as a sum 
of operators, each of which acts non-trivially on no more than k < n qubits. 


Definition 3.21 An operator A € ЦН") is said to be k-local if it is of the 
form 


А= m @ лый jai 9 Ај: 
jal 


where J C N and for each j € J and/ € (0,...,n — 1} we have aj, € C and 
Aj, € Ц"Н), and the index sets 


= {l € {0,...,п—1}|А„ #1} 


of qubits on which the A; & --- & Aj, act non-trivially satisfy |/;| < k. 


As any physical implementation of well controlled interactions of many qubits is 
very challenging one is clearly interested in cases where k «& n. 


Example 3.22 For j Є (0,...,n — 1} let 
321939519 


such that Z/ € L(*H") and with a(t), b(t), Kj, Jj € R let 
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n-l . n—1 | 
H(t) = a(t) У Ki + b(t) Y, Jiz 
j=0 310,1 


be a Hamiltonian оп “Н” of ISING-type [56]. Then Н(т) is 2-local. 


3.4 SCHMIDT Decomposition 


For pure states |) є НА & IH? in composite systems one can utilize the eigenvec- 
tors of the reduced density operators to obtain ONBs in H4 and HË, which allow 
a lean and useful representation of |). In the following we briefly present this 
construction, which is known as the SCHMIDT decomposition. 

Let 


|) = у olea e fo) 
a,b 


be a pure state in H^ @ Н? and let 


p4(") = у Ҹа ьа |а) (Cay | 


a1 ,a2,b 


be the corresponding density operator. Since p^(V) is a self-adjoint and positive 
operator on НА there exists an ONB {|é,)} in H^ consisting of eigenvectors of 
p^ (XP), such that 


piP) = Y qaléa) (éal . (3.59) 


where the qa > 0 are the eigenvalues. From (2.56) we know that the ONBs {|é,)} 
and {|e,)} are mapped into each other by a unitary operator U € U(H^): 


|24) = Ulea) = у eai) (еа |Оед) . 
—— 


а 
=WUaya 


With 
Vb = у Ua Tb 
а 


one finds 


\Р) xx Y Ule ® fo) E 
a,b 


which, according to Definition (3.44) of the reduced density operator, implies 
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р) = Y V, £e) (221. (3.60) 


a ,a5,b 


Comparison of (3.59) with (3.60) shows that 
У оа = nada (3.61) 
b 
has to hold. In particular, we thus have 


4=0 & Y,=0 vb. (3.62) 


For qa > 0 we define the vectors 


[а= g Lum c H^. (3.63) 


Qa 


The set of such defined |f;) is orthonormal since 


~~ 1 
(fa; | faz) — Уу учу, Ubilfo,) = DC 
1 2 da, qaz a 4101 ^a» ые, da, Gay Унь 1 a» 
=, 
= баа». 
(3.61) 
With this we obtain 
IY) = Y e; 2 fo) 
a,b 
= Y |) & убы) +> ae V ш fb) 
qa#0 qa=0 b ~~ 
=/@al fa) 
= у v/da|&a ® fa) ’ 


qa#0 


where in the second equation we used Definition (3.63) in the first sum and the rela- 
tion (3.62) in the second sum. Lastly, we can drop the restriction qa # О in the last 
equation, since the corresponding terms do not contribute anything. One can then 
also extend the set of orthonormal vectors |/,) to an ONB in IH? by supplement- 
ing the set with suitable vectors. Then basis vectors А) would also be defined for 
qa = 0. The result is the SCHMIDT decomposition of |У) є НА @ IH: 
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(P) = У Vases ® Ж). (3.64) 


Note that the ONB {|é,)} and the {|f,)} depend on |V), that is, for other vectors 
IÐ) € H^ & HË one in general obtains different ONBs {|é,)} and {fa}. With the 
help of Definition (3.43) of the reduced density operator it follows immediately from 
the SCHMIDT decomposition that 


p° (P) = Y galéa) (éal 


which is a necessary consequence of (3.59) since this was the starting point of the 
construction. From (3.64) and (3.45) it also follows that 


p*(*) = Y aol fo) (il - 
b 


The ONBs {[2;)} and {|f,)} in the SCHMIDT decomposition are only unique 
in case all non-vanishing eigenvalues of p4(4%)—and thus according to the above 
also those of p? (¥#)—are non-degenerate. In case a non-zero eigenvalue of p“(¥) 
is degenerate, the ONB in the corresponding eigenspace is not uniquely determined. 
Let d; > 1 denote the dimension of the eigenspace of the degenerate d-th eigen- 
value qa £ 0 of р^ (цр). Moreover, for k € {1,...,dz} let |ez4) be the eigenvectors 
belonging to qa. Then one has 


da 
р^(%Ф) = Y. galéa) (41 + аа У, |222) (Cae 
афа К=1 


da. сыл. 2. 
= У алё) (ёа + aa У, lea.) (ёа) 


ажа К=1 
with 


aS da 
leak) = У, Саја), 
1=1 


where Ug is the matrix of an arbitrary unitary transformation in the eigenspace for 
qa. Then one has for the SCHMIDT decomposition the following options 


IY) = Y, Vaaléa & fa) + уа У |22 & fa) 
К=1 


da? dà 


РЕ da „ы x 
£ \/да|ёа Q fa) + da У, lea ® Ја), 
К=1 


da? dà 


demonstrating the non-uniqueness of the ONBs in the case of degenerate 
eigenvalues. 
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3.5 Quantum Operations 


According to the Projection and Time Evolution specifications in Postulate 6 there 
are two ways a quantum system can change: by unitary time evolution generated by 
some Hamiltonian or by a state transformation effected by a measurement. 

Yet another way to generate a state transformation is to combine our system of 
interest with another system to a composite system. Then time evolution or measure- 
ments may be performed on the combined system after which the second system is 
discarded and only the first system is retained. This process of combining our sys- 
tem of interest with another system to a composite system on which some action is 
performed and then ignoring the added sub-system can come about in two ways: 


On purpose  Thatis, we want to make use of the added system as a computational 
resource. This is the case when we build circuits with ancillas (see Sect. 5.3). This 
includes the case where we might want to observe the added system, in other 
words, the ancillas, and where such observation has an effect on our principal 
system A. 

Byerror This happens when we cannot shield our system of interest and it inter- 
acts with the environment. This is the case we will need to deal with when we 
consider quantum error correction (see Sect. 7.3). Here, too, we include the case 
where the environment is observed and such observation affects the principle 
system. 


The notion of a quantum operation will be very useful to describe these state 
transformations in a rather compact way. As a start for preparing its definition in 
more detail we recap the stages of the state transformations alluded to above. 


1. We begin by preparing the principle system A of interest to us in the state 
p^ e (m^). 


2. We then proceed to combine system A in state p^ with a system B in the state 
pre D(H). System B will be the ancillas in case we are looking at circuits 
or the environment in case we are considering errors. We assume that the two 
systems A and B are initially separable. Mathematically we can describe this 
enlargement to a composite system as the embedding 


1 


: D(H^) — D(H“ @ H”) 
p^ —p'aepP  ` 


p? 


3. The time evolution U € u(H4 @ HP) of the combined system transforms the 
combined state as 


U : IH^ & H5) — ЦН“ & H5) 
p^& p? += U(p^&pP)U*' 


In general this will result in an entangled state of the combined system. 
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4. Let PP be the projector onto the eigenspace of an observable of system B. Sup- 
pose upon measuring this observable we obtain the eigenvalue corresponding to 
the eigenspace onto which P projects. According to (2.87) in the Projection 
Postulate for mixed states this results in the state transformation 


(1^ & Р8)0(р^ & pP)u* (1^ ® PP) 
tr ((14 & РВ)Ш(рА & p5)U*) 


U(p^ & pP)u* 
If we do not measure system B, we set PË = 18. Noting that then 


w(a^eP5u(p*ep^)u*) = w(utp*ep^u*) = w((p* e p^u*v) 
(2.58) 


= r (eteo) = (o) w (o^) 
(2.7) (3.57) 

Sy 1 
(2.83 


we see that in this case the state of the combined system remains U (p4 @ pP)U*. 
5. Discarding or ignoring system B we can still obtain a description of system A 
only by taking the partial trace over B: 
(14 & P®)U(p4 & pP)u* (14 & PP) tr? (a^ & PP)U(p^ & pP)u* (14 & Р8)) 
tr (1^ & PP)U (p^ & pP)U*) tr (14 & P?)U(p4 & pP)U*) 


where in the description of the final state on the right we have used the linearity 
of the partial trace to pull the denominator tr (- - - ) out of tr?. 


Altogether the initial state p^ of the principal system A of interest is thus trans- 
formed by the steps 1—5 as 


D(H^) — D(H‘) 
A, иЁ((14®Р#)ц(р^А®рВ)и* (1А®РВ)) (3.65) 
a tr((I4@P8)U(p4a@p8)uU*) 


It turns out that this transformation can be written in terms of suitable operators on 
IH^ only. Before we can establish this we need the following preparatory lemma. 


Lemma 3.23 Let Н be a HILBERT space and for 1 € {1,...,m} let Kj € 
ЦН). Then for any p € D(H) the operator 


К(р) = Y KipK; (3.66) 
nil 
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satisfies K(p)* = K(p) and 0 € K(p). Moreover, for any к Є]0, 1] we have 


3 


УКК <к1 e tr(K(p)Xzx Vp € DH) (3.67) 
1 


T 


and equality in one side of (3.67) implies equality on the other. 


Proof To begin with, recall from (2.83) that p € D(H) implies p* = p, p > 0 and 
tr (р) = 1. Then we have 


and likewise 
SAK | = У (кк) = KM) = MK. (3.68) 


Moreover, for any |y) € H 


m 


(v|K(p)v) = (vi È Kip Ki v) = У (v|KipK; v), = Y (Kj w|pK; v) > 
121 l=1 l=1-——~—— 
nt 30) 20 since p>0 


So far, we have shown K(p)* = K(p) and 0 < K(p). Next, we show = in (3.67). 
From (3.68) we know that У" , KK; is self-adjoint. Thus, there exists an ONB 
{|еа)} € H of its eigenvectors for its eigenvalues {Ла } such that 


Mn 


= Леа) (eal. (3.69) 


Q. bud є 


ll 
fae 


Consequently, we find for every eigenvalue A, that 


Ла = (ед| » x) £a) Sea (5 кк) еа) 
а! l=1 


(3.69) 
< (€q|Keag) = к. (3.70) 

YY 

(3.67) 
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Therefore, we obtain for any p € D(H) 
m 


tr(K(p)) = tr (5 кок) = У i (KPK?) =, Узок) 


i=1 i=] [1 


(3.66) (2.58) 
= ( $ кк) = т (Ае) = E Aote(plen) al 
= (3.69) Ё б 
< x (plea) (eal) = к У (ea |Pea) (ealeéa) = K 2, (ealpea) 
(3.70) (5) ® =б/ 
= кїг(р) = к (3.71) 
(2.57) (2.83) 


proving 
m 


VKKi< «Kl = tr(K(p))<« Yp € DOH). 
iz 


From the second line in (3.71) we also see that У" у КЁК = к1 implies 


tr(K(p)), = tr(pk) = Ktr(p) = « vp € DH). 


(3.71) (3.69) 


To show < in (3.67) note that the second line in (3.71) also shows that tr(K(p)) € 
к implies for every p € D(H) 


kou ( Y кю) = Yat (plea)eal) - 


1=1 (3.69) * 


Choosing р = |е) (е, |, we have tr (рев) (eal) = бла. It follows that Ag < к for 
all a and thus from (3.69) that У" , K Kj; < «1. Similarly, tr (К(р)) = к implies 
Xia Kr Kj = Kl. 


Event though the constituent maps 155, U(-)U*, 1^ & PP and tr? (-) in (3.65) 
operate on the composite state space рни Ф HP) the resulting state transforma- 
tion is a map from the state space D(H‘) onto itself. This raises the question if such 
a transformation can be expressed with the help of operators acting on Н only. The 


following theorem provides the results to answer this question affirmatively. 


Theorem 3.24 ([57]) Let H^ be a finite-dimensional HILBERT space and 
let 
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K : D(H’) — D«(B^) 


3.72 
p^ —— K(p^) БЕ 


be a convex-linear map where 
D«(H^) := {p € H^ | р =p, p 20, tr(p) x 1). 
Then the following equivalence holds for any к €]0, 1]. 


JK; € I(H^) forl € {1,...,m} 
3 HILBERT space HË, dim H? < co, with m < (dim HB)? such that 
V € B(H^ & HP), p^ € D(H) such that 


үзу < кив — (373) хи 
e 
and and 


K(p^) = t? (vt^ © р®)у*) (3.74) КОЕ Y p^k;. (3.76) 
iz 


Within this equivalence we have the special case 


m 
IM KU 
= 


Proof From Lemma 3.23 we know already that any superoperator of the form (3.76) 
where the K; satisfy (3.75) maps into D«(H^), that 1s, satisfies (3.72). Hence, it 
remains to prove the equivalence. 


We prove => first. Let V € L(H^ ® HP) be such that it satisfies (3.73) and (3.74) 
and let pP? € D(H®). Moreover, let (|e;)) be ап ONB in НА. From Theorem 2.24 
we know that there exists an ONB [|/;) ) C IH? and a set of q, > 0 such that 

У gue (3.77) 
b 


and 


P” = Y alfo) (fol - (3.78) 
b 
Using this, we also define 


Vp? = У уа) (fol (3.79) 
b 
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which satisfies 


(Vp?) Кыл? Vb; dps Mb.) (fo, |For) (fal = Z alfi) (fol = E (3.80) 
w 


(3.79) бю) Pide S, бу 78) 
(V/pP) = (Evan т) xe vas (1.fo) (fol) ce (fol 
zk (3.81) 


For bi, b» € (1,..., dim HË} we then define the operators K(5,.p, by specifying 
their matrix diemeni (Kn, b>) Jaia in the ONB {|е„)} as 


(К) аа = (V(1* & ур?) „ьа (3.82) 
Then we have 
(К, yan = Korma =, (VAA & УР?) „ьа, (3.83) 
(2.34) (3.82) 
REM A /p EN A / жүу* 
Кэл Де ® 3109 arb, ai 1 e p^) V jS 
(2.34) (2.47) 
EM A / * * u А ài 
SAG ® p” V К a 8 V pP)V Ган 
(3.31) (3.81) 


and thus 


» ЖОЛ) = 2 У (КЬ) аара (Къ, pa) an 
bib» ajaz bi, 5» 3,04 


i 2 У (V( v^ e vp?) Ja КОЛО a^ e v/pP)V V) boa 


(3.82),(3.83) 7122 43:04 


У > (va^ e V р®)) арады (Or e V PPV“) mh 


b1,b2,b3 43,44 


=já 
—Pa3a4 Ôb» b3 


(OP hri 
= уу У (V v^ e vp?) DJa PE ^ @15 )a3by,a4b3 


bi ‚Бә ba 3,04 
A * 
(a^ & V/pP)v*), ,. аы, 


= уз (va ® v/pP)(p^ e Eu 8 vV/pP)V*), barb 
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by (V(p^ e PV") ьар (V(p^ e pos. 


~ b 
(3.52) 


(3.80) 
_ А 

= Kp" aa 

(3.74) 


proving (3.76). The sums Y, p, run over the index sets indexing an ONB of H? and 
thus the total number m of operators Kj, b, cannot exceed (dim HË)?. To show that 
(3.73) implies (3.75) we note first that 


У (К, ь)К ь)) а» = M (Ks ъ,у)ааз(К(ь,ь›))аза» 

Ь\,Ь» by ,b2,a3 
м = (1^ 8 y pvo aab, (va^ 8 ү р®)) on аЬ» 
(3.82),(3.83) 2162.43 B 7 


У (4&8 ү/рВ)у*у(1^ e Мр T 


b 


v? (a^ & урв)у"у(и e ура) 


<> aja? , 
(3.52) 
such that 
PLC (a^ ә VPP va e p?) . (3.84) 
1,92 


Exercise 3.46 Show that (3.84) implies for any |y) € НА ~ {0} that 


(VI Y, Къы) = TTE tr ((u)(vl & у/р®)у*У (у) (wl ® vo”) . 
UU (3.85) 


For a solution see Solution 3.46. 


With the help of (3.73) we can establish an upper bound for trace on the right side 
of (3.85). 


Exercise 3.47 Show that (3.73) implies for any |y) € H^ that 


t ((w)(vl e VPV Vly) yio Vo”) xlvi. (386) 


For a solution see Solution 3.47. 
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Together (3.85) and (3.86) imply that for any |y) € H4 


(v| Y, Kj, by) Koo) V) € к = (vixi v), 


by ,b2 


which by Definition 2.12 is equivalent to (3.75). 
For the special case V*V = «14? we have 


У, Ki by Kbib) Nu tr? | (17 ® ур?) viv (at ® vp”) 


bib (3.84) «ТАВ 
= xu? (a^ ® ү/р®)(1^ ә \/р®)) 


= As pB\) у By 4A 
= Kt” (1^ @ p*)) = xtr(p^)1 
(3.80) (3.57) 
= xi. 
Ww 
(2.83) 
To prove < let K; € ЦІНА) for 1 € {1,...,m} be such that they satisfy (3.75) 
and (3.76). Furthermore, let Н” be a HILBERT space with an ONB {| fo) | be 
{1,...,m}}. We embed H^ in НА & HP by 


1: НА — H^ @ HË 
lv) — |y & fi) = lv) & |fi) 


and define . 
V: H^) — H^ g HË 
m . (3.87) 
|y А) — LE, Kil) ® |) 
Exercise 3.48 Show that for a V defined as in (3.87) one has 
y m 
(уел = EIK e (fil. (3.88) 


[=1 


For a solution see Solution 3.48. 


For any |y & Л) € {H4} the linear operator V satisfies 


vefiV'V(vef)) =, (W(wef)l(wef) 


(2.30),(2.31) 
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E » (Ki y & fi Kn V ® fr) 

(з.87),(2.4) ' 

ze Хаин) (alfo) = УКК) 
(3.4) ои 


к (3.89) 
1 


We thus have 
УКК, < к1^ 
1 
э, MEK Ky) < «lly? = кА viv) em 
l 


(wefiV*Vwef)sskxliwefhl у) олеин} 


VY xxr 


where equality implies equality in each step. The operator V is defined on the 
dim Hi4-dimensional subspace :(IH^ C НА @ HË of the HILBERT space НА c Нё 
of dimension (dim НА) (dim H7). To extend V to an operator V on all of НА c Нё 
we use the result of Exercise 3.49. 


Exercise 3.49 Letm,n € N with n > mand A € Mat(n x m, C) as well as c €]0, 1] 
be given. Show that then we can always find B € Mat(n x (n — m), C) such that 


V= |A В| c Mat(n x n, C) 


satisfies 
A*A 05 (n—m) 


VV = ( ) € Mat(n x n, C), (3.90) 
O(n—m)xm Cl, m)x (n—m) 


where Окуу, 1,..; denote the zero resp. unit matrix in Mat(k x I, C) 


For a solution see Solution 3.49. 


By choosing c = к in Exercise 3.49 we can extend V to an operator V on all of 
H^ & HP such that V*V < «14? if Y; KT K; < к1^ or V*V = к148 if Y; КЎК = 
K1^. Thus, we have shown that (3.75) implies (3.73) including the special case of 
equality. 
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To show (3.74), we set 
P = (fi) (fil e D(H”) (3.91) 


and recall that any p^ € D(H") can be written in the form 


^ = Y palea) leal, (3.92) 


where the ра Є [0, 1] satisfy 


Nu 1, 
a 


and the {|e,)} form an ONB in НА. Therefore, we obtain 


V(p4 & pP) È, PaV (lea) (eal & |f) CA DV" 


(3. n (3. 92) * 
У PaV lea ® fi) (ea & AIV", (3.93) 
(3.36) 
where 


Vlea & fi) = V|ea & fi) =, Y. Kilea) & |7) 
1 
(3.87) 


" om Р (3.94) 
(ea D fi]V* = (ea & filV 5 È (elki 8 (fil - 
(3.88) ! 
Using (3.94) in (3.93) yields 
У(р^®р®)у* = > pa(Kilea) ® |fi)) (ек ® (ful) 
aly ly 
E X ple) leal Kh © lin) fal 
(3.36) 2102 
= Ук (Уе) кә) 
ib 
Y Kap Ki, & lfa) (fal - (3.95) 


(3.92) lib 


Taking the partial trace over Н? it follows that 
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t” (V(p* ё р?)у") = tr” (z Ki p^K;, ® лушы) 


(3.95) tub 


tr? (Ki, PK} & |fi,) (fol) 


= 2 
= Хе r (1fn) (ful) Ki p^ Kis , (3.96) 
1.2 


where we can use 


tr (Lf) (fil) =, ОыЛ,)\%|%) = у бы, ôn b = $12, 
(2.57) ? b 


such that (3.96) becomes 


tr? (V(p^ & pP)v*) = ZB = Kp") 
am 


verifying (3.74) and completing the proof of <. 


Note that Theorem 3.24 does not assert that every convex-linear map as in (3.72) 
does have one of the equivalent forms (3.74) or (3.75). It merely states that if one 
exists then the other does, too. 

However, it can be shown that any completely positive linear map Ф:р +> Фр 
which satisfies (Фр)* = Фр and tr (Pp) < tr (p) is indeed of the form given by 
(3.76) with (3.75) [58, 59]. The infinite-dimensional version of this statement is 
known as the STINESPRING factorization theorem [60]. We shall not pursue this 
generalization here, as the results stated in Theorem 3.24 are sufficient for our pur- 
poses. 

Before we give a formal definition of a quantum operation it is useful to exhibit 
the relations between inequalities for the operators V*V or Y; Кү Ку and the trace of 


K(p^). 


Corollary 3.25 Let Н^ and HP be finite-dimensional HILBERT spaces and 
let K : D(H‘) — D«(H^) have the equivalent representations given in Theo- 
rem 3.24 with V € L(H^ @ IH), pre D(H) and Kı € цн) Јог 
l € 11,...,т}. For any K €]0, 1] we then have 


VV < KI? e VER < кі e t(K(p*))<« vp^*er(m), 
1 


and equality in one relation is equivalent to equality in the other two relations. 
In particular, for equality with K = 1 we have 
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Ve щн“ ® н») e Ук к= 10 etu (K(p*)) =1 vpre D(H") г 
1 


Proof From Theorem 3.24 we know already that 


у*ў<кї® о УКК xxr 
1 


with equality оп one side implying equality on the other and from Lemma 3.23 we 
know that 


SKK) < кА e t(K(p))zx Vp* € D(H), 
1 


where again equality on one side implies equality on the other. 


We are now in a position to define quantum operations. For our purposes it is 
sufficient to consider the finite-dimensional case and to make do without the general 
axiomatic approach utilizing the notion of complete positivity. 


Definition 3.26 Let H be a finite-dimensional HILBERT space. A quantum 
operation is a convex-linear map 


K : IH) — D«(H) 
p = К(р) 


that can be expressed in ће two equivalent forms (3.74) and (3.76) given in 
Theorem 3.24. The representation (3.76) of the form 
m 
K(p) = У, KipK; , (3.97) 
[ms 
where the K; € ЦН) for! € {1,...,m} satisfy 
m 
yX Kj К < il р 
1=1 


is called operator-sum representation of the quantum operation К. The К; 
are called KRAUS operators or operation elements of the quantum opera- 
tion. The representation (3.74) of the form 


K(p) = ti? (V(p & p*)V*) 
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using an additional HILBERT space HP, where V € В(Н & HP) satisfies 
VV << IL. 
is called environmental representation of К. 
If 
m 
у са 
і 


(and thus equivalently tr(K(p)) = 1 = tr(p) for all p € D(H)), then the 
quantum operation is called trace-preserving or quantum channel and con- 
stitutes a map K : D(H) — D(H). 


The Кү in the operator sum representation (3.76) of K depend on the р? that 
is used in (3.74) to build K. The construction of the K; in (3.82) in the proof of 
Theorem 3.24 used the representation of p? given in (3.78). However, from Propo- 
sition 2.27 we know that such a decomposition of a given density operator is not 
unique. This non-uniqueness carries over to the KRAUS operators, which are thus 
not unique either. 


Corollary 3.27 Let K : IH) — D<(H) bea quantum operation with KRAUS 
operators Кү Є UH), where 1 € (1,..., mj. Moreover, let m > m and U € 
U(m). Then the K; € ЦН) with j € (1,..., m) given by 


m 
K; = у UK; (3.98) 
I= 


are KRAUS operators for K as well. 


Proof To begin with, note that 


01кг = > UGK; , (3.99) 


such that 


У, К Z > (5 шк) ($ vak) = x (š 223 Kj Ky 
= = 


(3.98),3.99) 7! M-1 k=l j=l 
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m m 
= M (UU), KiKi = У КЁК, < к1, 
Ms 1-1 
—Olk 


and the K; satisfy (3.75) because the K; do. The proof of (3.76) is almost identical 
since for апу p € D(H) we have 


m m m m m m 
У Кок - У р ик) р р 79 e р 2 Kj pK. 
j=l (3.98),(3.99) j=! \l=1 k=1 Lk=1 \j=1 


= b (U*u), Kj pK = b Kr pK, = K(p) 
Lk=1 мм 1=1 


=O 


and the K; also satisfy (3.76) because the K; do. 


We return to the motivating considerations for quantum operations given at the 
beginning of this section and show how quantum operations provide a compact 
means for the description when a system H^ is combined with another system Н, 
which, after some interaction, is subsequently ignored. Recalling the resulting state 
transformation (3.65) from such process steps 1—5 discussed at the beginning of this 
section, we see from the results in Theorem 3.24 that this state transformation can 
be formulated with the help of the quantum operation 


K(p^) = и” (V(p^ & pP)v*) (3.100) 
in its environmental representation (hence this name), where 
V = (1 & P?)U (3.101) 


with U € U(H4 @ HP). 


Exercise 3.50 Let a quantum operation К be given in the environmental represen- 
tation (3.100) with V as in (3.101). Show that then 


tr (1^ & PP)U(p^ & pP)U*) = tr (K(p^)) . (3.102) 


For a solution see Solution 3.50. 


Using (3.100) with (3.101) and (3.102), we see that in the total state transformation 
(3.65) from the process steps 1—5 discussed at the beginning of this section we have 


tr? ((14 & PP)U(p^ @ pP)u* (1^ & PP)) K(p^ 


tr (14 & PB)U (p4 @ p8)U*) tr (K(p4)) ` 
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Consequently, the total state transformation obtained when our system is 


. initially prepared in state p^ € D(H4) 

. combined with another system 

. subject to the time evolution of the combined system 

. subject to possible measurements on the newly added system 

. viewed in isolation after discarding the intermittently added system 


л шә м н 


can be expressed succinctly with the help of a quantum operation К in ће form 


D(H^) — D(H) 
K(p^) 
pe R i 


This form to represent the state transformation will be used in the context of quan- 
tum error correction in Sect. 7.3. 

In case the time evolution U € (на & HË ) of the combined system acts sep- 
arably on the two sub-systems H^ and Н? in the sense that it commutes with the 
measurement projections 1^ & PP on sub-system HË, the trace of the overall quan- 
tum operation can be determined from the product p^ PP as the following corollary 
shows. 


Corollary 3.28 Let K : D(H‘) = D«(H^) be a quantum operation in the 
environmental representation given by 


K(p^) = t” (1^ & PP)u(p^ & pP)u*(1^ & P^), (3.103) 


where РВ € ЦН) is ап orthogonal projection, U € u(H4 & HË ) and pP € 
D(H? ie Then we have 


Ио > tr(K(p4)) = tr(pPP^)  vp^ e оН“) 
and in particular for РВ = 1? it follows that then 


tr(K(p^)) =1 vp^ e D(H‘). 


Proof 'The quantum operation K in (3.103) is in environmental representation with 
V = (1^ & PP)U such that 


v* = ((1%®РЁ)ш\* 


mE *(4A B 
= ya^ ep) (3.104) 
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and thus 
V'V = U'*"(1^ePP)^ePP)u = U* (1^ e (PP)u 
Ww 
(3.104) 
__ *(1À B = * A 
= U*(1^ePP)u = U*U (1^ & PP) 
Def. 2.11 ПА &PP,U]—0 апа (2.11) 
ES A 
= 1^®РВ. (3.105) 
(2.37) 


From (3.84) in the proof of Theorem 3.24 we recall that we have a set of KRAUS 
operators K; for K such that 


DKK = л (a^ & ү/р®уу”у a e vp?) 


(3.84) 
„= (a^ ® Voa ® Pate v/pP)) 
(3.105) 


= yg? (e рЁРЁ Гр?) 


(//р#Р# Vp”) 14 ур?) 1^ 


= tr 
м 
(3.57) 

B pBY 4А 
— tr P^)l. 
Lu (pP) 
(3.81) 


= tr ( 
(2.58) 


Applying Corollary 3.25 with x = tr(op^PP) then implies that tr(K(p)) = 
tr (pP PP). If PP = 1, then tr(K(p)) = tr (pP) = 1 since p? € D(H’). 


Finally, note that the domain D(H) of a quantum operation K is a convex set, that 
is, for each p1, p2 € DH) and и є [0, 1] we have 


Api + (1 — u)p2 € DH), 


and every quantum operation К is convex-linear, which means that for any p1, p» € 
D(H) and и € [0, 1] it satisfies 


K(upi + (1 — u)p2) = uK(pi) + (1 — и)К(р›). (3.106) 


When the system consists only of a single диби we have Н = *Н. In this case we 
know already from (2.127) that every p € D(H) can be described by an x € Bl, in 
the form 


рх = s(1+x-0). (3.107) 
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Hence, any image of a trace-preserving quantum operation K : DX*IH) — IX*H) on 
a single qubit has to be of the same form 


K(px) = 5 (1+ ¥(x)-0), 


and from Exercise 2.30 we know that у(х) = tr (K(px)o). As a consequence, every 
trace-preserving quantum operation K on a single qubit defines a map 


R? (3.108) 


In other words, every trace-preserving quantum operation K induces a map K of the 
BLOCH ball B}, onto itself. 


Exercise 3.51 Show that K given by (3.108) is convex-linear, in other words, that 
it satisfies (3.106). 


For a solution see Solution 3.51. 


Different types of trace-preserving quantum operations K on qubits can thus be 
visualized as deformations of the BLOCH ball Bis effected by K [59, 61]. 


3.6 Further Reading 


Material on tensor products of HILBERT spaces (and a lot more on operators, in 
particular in the infinite-dimensional setting) can be found in the first book of 
the multi-volume series by REED and SIMON [50]. Chapter 2 of the book by 
PARTHASARATHY [62] contains a very detailed but rather advanced exposition of 
many aspects around states and observables in tensor products of HILBERT spaces. 

For a condensed and modern coverage of quantum operations including physical 
aspects thereof the reader may consult the treatise by NIELSEN and CHUANG [61] 
or for a geometrical view the book by BENGTSON and ZYCZKOWSKI [59]. 


Chapter 4 (R) 
Entanglement шры 


4.1 Generalities 


The notion of entanglement goes back to SCHRODINGER [7]. The existence of 
entangled states is arguably the most important difference between classical and 
quantum computing. Indeed, the existence of entangled states allows new effects 
like teleportation and new algorithms like SHOR's algorithm, which performs prime 
factorization much faster than with a classical computer. Before we concern our- 
selves with these in Chap. 6, we first want to look at entanglement and some of its 
resultant effects, which are at odds with our intuition, in this chapter. 

We begin in Sect. 4.2 with a mathematical definition of entanglement and present 
a handy criterion to test, if a pure state is entangled. 

In Sect. 4.3 we then show, how entangled states can be generated even though the 
sub-systems have not interacted before. This effect has become known as 'entangle- 
ment swapping’. 

The second essential difference between classical and quantum computing is the 
existence of incompatible observables and the fact that they cannot be measured 
sharply (see Sect. 2.3.1). That entanglement together with the inability to measure 
incompatible observables sharply lead to effects which contradict our intuitive under- 
standing of reality and causality has been exhibited by EINSTEIN, PODOLSKY, and 
ROSEN [4]. This has since gained prominence as the EPR-paradox and was meant 
by the aforementioned authors to show that quantum mechanics does not give a com- 
plete description of reality. We shall examine this line of arguments in Sect. 4.4. 

The supposed incompleteness of quantum mechanics initially lead to the con- 
cept of additional hidden variables, which are not captured by quantum mechan- 
ics. Such variables were assumed to determine the outcome of experiments, but 
the observer's ignorance of them leads to the observed statistical character of mea- 
surement results. Assuming that such local! variables exist, BELL [63] derived an 


! Local means here that the variables of one system do not depend on those of another space-like 
separated system. 
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inequality for correlations of various measurable observables. The existence of vari- 
ables not captured by quantum mechanics would thus resolve the EPR-contradiction 
to our intuitive understanding of causality and reality and at the same time imply 
the BELL inequality of correlations. Experiments have shown, however, that certain 
quantum mechanical systems violate the BELL inequality [9]. If these systems had 
been describable by hidden local variables this should not have happened. Faced 
with the EPR-alternative 


(1) quantum mechanics provides a complete description of a system 
(2) our usual intuitive understanding of reality and causality applies to all systems 


nature thus obviously voted against (2). These questions in connection with the EPR 
paradox and the BELL inequality will be treated in more detail in Sect. 4.4. 

At first glance the properties mentioned in the context of the EPR paradox may 
lead to the belief that they could be used for transmitting signals with a speed greater 
than the speed of light. However, such a device, which has been coined a BELL 
telephone, does not exist as we shall show in Sect. 4.6.1. In Sect. 4.6.2 we shall 
consider another impossible device by showing that no apparatus can be built that 
copies arbitrary unknown qubits. 


4.2 Definition and Characterization 


We begin by establishing the following result about combining density operators of 
sub-systems to form a density operator of the composite system. 


Exercise 4.52 Let H^ and Н? be HILBERT spaces. Show that 
p*eD(H*) forxe{A,B} => р^®р#єр(Н1®Н°). (4.1) 


For a solution see Solution 4.52. 


With (4.1) we can give a general definition for entanglement, which also applies for 
mixed states. 


Definition 4.1 ([64]) A state p € D(H“ & HP) in a composite system H^ & 
Н?, which is composed of the sub-systems IH^ and Н? is called separable or 
product-state with respect to the sub-systems НА and H”, if there exist states 
р^ € D(H") in sub-system H^ and р? є D(H”) in sub-system H” indexed 
by j € I CN together with positive real numbers p; satisfying 


Ур = 1, 


jel 
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such that 
p=} Pip; ®р?. (4.2) 


jel 


Otherwise, p is called entangled. 


In general, the defining properties in this definition are not easy to ascertain such 
that this definition alone does not provide a practical criterion to determine if a given 
state is entangled or not. The search for alternative characterizations of entangle- 
ment for truly mixed states is still the subject of ongoing research. For our purposes 
it suffices to restrict our considerations to pure states only. The following theorem 
thus provides an alternative criterion for separability of pure states. Indeed, the cri- 
terion given there is often stated as defining criterion of separability for pure states. 


Theorem 4.2 A pure state |P) c H^ c HË is separable, if and only if there 
exist pure states |ф) € H^ and |y) € Н? such that 


IP) =|9) 8 v). (4.3) 


Otherwise, |) is entangled. 


Proof First, we show that (4.3) is sufficient for separability. Suppose we have |^) = 
Io) S |y) € H^ & H”. Then it follows that 

pP), = |P)(P| =|92 v)teewv|, = |eelelv)tvl- 
(2.89) (3.36) 


Setting p^ = |ф)(ф| and p? = |y) (|, this amounts to (4.2). 
To show that (4.3) is also necessary, let p be a pure and separable state. Hence, 
there exist p$, p? and p; for j € I as in Definition 4.1 and |У) € H^ & H, such that 


P=} pipi Sp} 
jel 
and simultaneously 


р = me. 44) 


We now show, that then there exist |p) € H^ and |y) € IH? such that |У) = |ф)® 
|y). For all j € 7 we set 
р; =P} QPF. (4.5) 
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From (4.1) we know that every p; defined as in (4.5) is a density operator, in other 
words, every p; is self-adjoint, positive and has trace 1. From 1. in Theorem 2.24 
we know that then for every j € / there exist ру €J0, 1] with k € J; C N satisfying 
Leer, рук = 1 and an ONB ([Q;4) | k € (1,...,dimH^ @ H^) j of H^ & H” such 
that 


Pj= > Pjxl Qj) (Qj. (4.6) 
kel; 


We extend |У) to another ONB { |\Р), |Ҹ) | le (1,...,dimH^ & H^ — 1}} of H4 Q 
HP. It follows that 


0- KEPP = (t) = Y, ру (1р9) 


jel 


and, since p; > 0, we must have (%|p;%4) = 0 for all j € J and | € {1,...,dimH4 & 
IH? — 1}. Together with (4.6) this implies 


у рук (Ell =0 
kel; 


and thus, again because pj, > 0, for all / € (1,...,dimH^ & HË — 1}, j € J and 
kel; 
(10у) = 0. 


Hence, for every j € J and k € J; the basis vector |Q; x} is orthogonal to all |Ҹ) from 
the ONB {|¥),|¥%)|/ € (1,..., dimH^ & H? — 1) ). Consequently, every |Q; к) is 
in the ray (see Definition 2.14) of |) and there exist 0; к Є R such that 


lQ jg) = elo en). 


This implies 
рў®рў = PiE D Pine H PP e 7 = У pi [P)(P| = |) (| 
(4.5) (4.6) kelj kelj 
—— 
=1 
22Р 
(4.4) 


and thus there are p^ є D(H") and p? € D(H?) such that for all j € 7 


р;=р^®р#=р. (4.7) 


With the help of the SCHMIDT decomposition (see Sect. 3.4) we can find qa Є]0, 1] 
and ONBs {|ea)| a € {1,...,dimH*}} and (|f) | b € {1,...,dimH}} such that 
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we can write 


№) = >) Vaalea) ® |). (4.8) 
This implies 
p^ Bp = p, = [W)(| = Уча еге & fo) fol (4.9) 
(4.7) (4.4) , 


such that in the ONB [|e;) & |f) ) of H^ @ HË we see that p has the matrix 


(р^)аа» (р®)ьь, = Payby aby = Vay day ab оь - 


From this it follows that 
p^ Ep (p) = Y алел) (eal 


4.10 
p? =t(p) = Sault) (fl. S 
b 


Now, 
us tr(p), = (p°) = tr((p^)* & (p^)?) 
(2.82) (4.4) (4.9) 


"ie F (ес ® fal Y, ailea 8 fo) (ea ес fa) 
са a,b 


2..2 2 2 
= у qadr ca Оаь =} didi 


a,b,c,d a,b 
2 
(ха) (4.11) 


where q, € [0, 1] for all a. On the other hand, it follows from (4.8) that 


S аа = |[Ф|| = 1. (4.12) 
а 


Together (4.11) and (4.12) imply that there сап be only one â with да = 1 and else 
qa = 0 for all a Z â has to hold. Consequently, (4.10) becomes 


р^ = |е) leal and р? = |3) lhal, 


and (4.8) implies 


|) = lea) 8 | fa) - 
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Even the statement in Theorem 4.2 does not suit itself to an easy way to test if a 
pure state is separable or entangled. For example, consider the state 


IP) = = (100) + |01) + |10) +|11)), 


1 
2 


for which it is not obvious that it is a separable state, which, however, it is since 


ors py s BET 
v2 м 


How do we then find for a given |W) a |o) € H^ and а |y) € H? such that 
[V = |E) & |y) or how do we exclude that there exist such vectors |p) and |y)? In 
other words, how does one verify separability or entanglement? For pure states the 
following theorem provides a helpful criterion for that query. 


pue 


Theorem 4.3 For pure states |W) € H^ @H the following equivalence holds 
|W) is separable <= — p* (VP) is pure for all X € {A,B}. 
or, equivalently, 


|Ҹ) is entangled = — p* (VP) isa true mixture for any X € {A,B}. 


Proof The two statements are, of course, equivalent. It is thus sufficient to prove 
only the first statement. We show => first. Let |F} be separable. Then we know 
from Theorem 4.2 that there exist |p) € H^ and |y) € HP with |У) = |ф) & |y). 
Because of 


= 11| = v Cn). =v elev (уу) — llel 


(3.4) (2.5) 


we must have ||@|| 4 0 Z ||w||. We define the unit vectors |е) :— T and | fo) := 


E and augment them by suitable vectors |e1),|e»),... апа |f1), |5),... in order 
to form the ONBs 
(le) = dE еа), JCHA аш 1л) = ТӨ Ыл], C BP, 
lloll Ily 
such that 


IP) = lo) ely) = lloll llyllleo) 8 |fo) = У, Flea) 8 [fo) 5 


a,b 
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where | 
yp, — J llellllwl] — 1 #а=0=Ь 
d 0 else. 


Thus, we have 


p^(V)- Y, аьа) al Ilellllwll leo (eo| 


a ,42,b 


leo) (ео, 


which as a projection onto a one-dimensional subspace is a pure state. Consequently, 

it satisfies (pe) = |eo) (eo|eo) leo| = p^ (X). Similarly, one shows p? (¥) = 
1 

| fo) (fol, proving that pP (V^) is a pure state as well. 

We proceed to prove the reverse implication <=. Let p4() be a pure state. 
Hence, there exists a unit vector |p) € H^ such that p^(V) = |o) (|. This den- 
sity operator р^ (V^) has exactly one eigenvector with eigenvalue 1 and a degenerate 
eigenvalue 0. According to the SCHMIDT decomposition (3.64) the vector |) then 
has the form |¥) = |ф) Q |y) with unit vectors |ф) € H^ and |y) є HP. The same 
arguments apply if p? (V^) is assumed as a pure state. 


Definition 4.4 А pure state |) in the tensor product of identical HILBERT 
spaces IH^ is said to be maximally entangled if 


p^(w)- A1 


with 0 « À « 1. 


From (3.55) and the result shown in Exercise3.44 we see that the vectors 
|Ф=), |=) of the BELL basis are maximally entangled. 


4.3 Entanglement Swapping 


As we shall see in Sect. 4.4, entanglement leads to phenomena, which EINSTEIN 
called ‘spooky action at a distance’ and which contributed considerably to his doubts 
about quantum mechanics. It may thus seem even more spooky that systems can 
be entangled even if they have not interacted with each other. This phenomenon, 
which has become known as entanglement swapping [18, 65, 66], has indeed been 
performed experimentally [67]. It comes about as follows. 
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Suppose a four-qubit state |Ф)^2С0 є H4 @ "HP @ HE @ HP =: НАВ©Р has 
been prepared as a separable product-state of two entangled two-qubit BELL states 
| )48 c THA @ TH =: НА and |)? c HEHP =: НСО such that 


|DYABCD _ jy) AB g jys—)CD 
= 5 (10101) — 10110) — |1001) + |1010)) 
= (тту? [PEBE — ey g pr ус (4.13) 
-|9*'? e |o*)*€ + |o- ^P & o^), 
where, for example, 


je? e pe** = 2 (pe [[0)#® 1)©+ 1)#® |0)°] erm? 
+ [n^e [0)#® 1)©+ [0^ 810°] eq?) 
= 5 (0011) +10101) + 1010) + [1100)) . 


Systems A and B may have interacted in some way to form the entangled state 
[P —)^2. Likewise, systems C and D may have interacted to form the entangled state 
| —)€P. However, we can prepare the entangled states | )^8 and |W¥~)“ such 
that system A has never interacted with either C or D or be influenced in any way 
by these systems. Nevertheless, we will now show that by suitable measurements 
in the state |Ф)АВСР of the total composite system it is possible to create entangled 
states in the system AD composed of the sub-systems A and D. 
From (3.41) we see that the operators 


ZPE = 1@0,80,81 
ХВС = 1®оу®оу®1 


commute. Hence, the corresponding observables BC-spin in the z-direction апа ВС- 
spin in the x-direction can both be measured sharply in a given state. The measure- 
ment of the observables defined by DPC and ХВС in the state |Ø)48CP collapses 
the state of the qubit-pair BC to one of the states |¥*)8° or |Ф=)2С depending 
on which values have been observed. In Table3.1 we can read off, which BC-state 
corresponds to which pair of measured values. If, for example, for (XPC, ХС) the 
values (—1, +1) have been observed, then the particle-pair BC is in the state |Ч'+)5С 
The middle column in Table 4.1 lists, in which state in НАРС? the composite system 
is after measurement, given the observed values of Х2С and EFC. 

With regard to the sub-systems AD and BC the composite system is thus after the 
measurement always in a state separable in the BELL basis vectors in H4? and HC, 
If we only consider the sub-system AD the reduced density operators p^? of the 
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Table 4.1 Determination of post-measurement state by measurement of Х2С and Х2С on |Фу45СР 


Measured value of Composite state after | State of sub-system 
measurement of 280 AD after measurement 
апа XPC of ХВС and XP^ on 

|@)ABCD 


states in the middle column of Table 4.1 represent pure states as given in the right 
column of Table 4.1. Thus, after the measurement of 286 апа УРО the qubit-pair 
AD is in the state that in (4.13) is paired with the observed BC-state. This observed 
BC-state is given by the pair of measured values for 206 апа УВС. Consequently, 
after the measurement ће qubits А апа D are entangled even though they have not 
interacted with each other at all. 


4.4 EINSTEIN-PODOLSKY-ROSEN-Paradox 


We begin by exhibiting a slightly modified version of the chain of arguments given 
in the original article of EINSTEIN, PODOLSKY and ROSEN (EPR) [4]. The ori- 
gin of this article was EINSTEIN's dissatisfaction—or even rejection—of quantum 
mechanics, which he considered ‘incomplete.’ The goal of the arguments given by 
EPR is thus to show that the following statement is wrong. 


EPR Claim 1 The quantum mechanical description of a system by its state 
vector is complete. 


For simplicity we shall abbreviate EPR Claim 1 as: 


Quantum mechanics 
is complete. 


Accordingly, the negation of this statement will be abbreviated as ‘Quantum mechan- 
ics is incomplete.’ 
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EPR then begin by considering what constitutes a complete description of the 
reality of a system by a physical theory. Their minimal requirement for a complete 
theory of a system is that every element of the physical reality of the system must 
have a corresponding element in the physical theory. What then are elements of real- 
ity of a system? For the arguments of EPR it suffices that certain physical quantities 
constitute elements of reality. In their definition a physical quantity is an element of 
reality of a system if the value of this quantity can be predicted with certainty, that 
is, with probability equal 1 without having to interact with the system. For example, 
our experience tells us that a pencil resting on a table exposed only to the gravita- 
tional pull of the earth and the opposite neutralizing force from the table-top will 
remain at the same place. We can thus predict the physical quantity ‘position’ of the 
system ‘pencil’ with certainty without looking. Consequently, for the system pencil 
the physical quantity position constitutes an element of its reality. Now, consider a 
qubit described by the state |0) = | Tz). Since |0) is the eigenvector for the eigen- 
value 4-1 of the observable spin in the z-direction, we know without measuring that 
the value of the physical quantity 'spin in z-direction' is 4-1. For qubits described by 
the state |0) the spin in z-direction thus constitutes an element of their reality. On the 
other hand, we cannot predict with certainty the value of the physical quantity 'spin 
in x-direction’ for a qubit described by the state |0) since |0} is not an eigenvector 
of Oy, and one finds for the uncertainty (see (2.79)) in this case 


Ajo) (Gx) = 1. 


Hence, for a system prepared in the state |0) spin in x-direction does not constitute 
an element of its reality. In general, quantum mechanical observables M; and М» 
of a system cannot be jointly elements of reality if they do not commute, that is, 
if M1 M» # ММ}. This is because in this case not all eigenvectors of M; can also 
be eigenvectors of M». But the value an observable reveals, when measured, can 
be predicted with certainty (in other words, with vanishing uncertainty) only if the 
system is in an eigenstate of the observable. Consequently, the values of M; and М» 
cannot be predicted jointly with certainty if Му М» 52 ММ}. We formulate this as 


EPR Claim 2 The physical quantities of a system belonging to two incom- 
patible observables cannot be jointly elements of reality for that system. 


We abbreviate EPR Claim 2 as 


The values of incom- 
patible observables 
are not jointly real. 
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The negation of this statement is abbreviated accordingly as “The values of incom- 
patible observables are jointly real.’ 

EPR show then that the completeness of quantum mechanics (EPR Claim 1) 
implies EPR Claim 2. To do this they apply the implications of quantum mechanics 
about sharp measurement results and uncertainty as follows: suppose, the negation 
of EPR Claim 2 were true, in other words, the physical quantities corresponding 
to two incompatible observables of a system were both elements of reality of that 
system and thus could both be predicted with certainty. If the quantum mechanical 
description were complete, that is, if EPR Claim | were true, then the state vector 
should provide a prediction of the values with certainty. But it does not, since the 
observables are assumed incompatible. Hence, we have the implication 


The values of incom- 
patible observables 
are jointly real. 


Quantum mechanics 
is incomplete. 


Contraposition of this implication yields 


The values of incom- 
= patible observables (4.14) 
are not jointly real. 


Quantum mechanics 
is complete. 


EPR then proceed to prove with the help of entangled states and a ‘reasonable defi- 
nition of reality’ that apparently 


The values of incom- 
= patible observables (4.15) 
are jointly real. 


Quantum mechanics 
is complete. 


holds. 
This is the EPR paradox: the implications in (4.14) and (4.15) cannot be simul- 
taneously true. EPR conclude from that, that then 


Quantum mechanics 


is complete. is FALSE 


has to hold, and to show that was the goal of EPR in [4]. There EPR demonstrate 
the supposed validity of (4.15) with a line of arguments, at the end of which they 
make use of a reasonable definition of reality, which we shall look at in the follow- 
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ing. That (4.15) does not hold after all, comes from the fact that the reality of the 
considered systems, is surprisingly *unreasonable' to a degree, which EPR in [4] did 
not believe possible. However, this counter-intuitive reality of quantum mechanical 
systems has since repeatedly been confirmed in experiments. 

Let us then have a look at the chain of arguments, suitably modified for our 
know-how that EPR provide for the proof of (4.15). For this we consider BOHM's 
version of the EPR thought-experiment, which should be readily digestible with the 
material presented in previous chapters. Consider the preparation of two qubits, the 
composite system of which is described by the BELL state 


LS A. 
v2 v2 


Of these qubit A is accessible to Alice and qubit B to Bob. We further assume that 
EPR Claim 1 holds, in other words, that quantum mechanics provides a complete 
description of the system and all predictions can be obtained from the state |^). 


Ф+)= — ((00) +|11)) = — (t2eltà--l12 ello). — «19 


Exercise 4.53 Show that for the eigenvectors | 1%) and | |) of 6; for the eigenval- 
ues +1 


| Tx) 6 | Tx) +] Le) & | Le) = |00) + |11) (4.17) 
holds. 


For a solution see Solution 4.53. 


From (4.16) and (4.17) it follows that 


І 1 
v2 v2 


A measurement of the observable o; by Alice in her sub-system is a measurement 
of 6, © 1 in the composite system. The eigenvalues of this composite observable are 
+1 and are degenerate. The eigenspaces for the eigenvalues +1 are 


B+) = — (I98l12--1198112) = 7 (I981 Te) +1 Le) e 13) (18) 


Eig(0:, 4-1) = Span (| 12) ® ци) | |у) Є "9° } 
Eig(o., 1) = Span (| |) ® |y) | Iv) ЄН}. 


The projections onto these eigenspaces are 


Pa-|f202|891 аай Р—у=|)(Ь»|®1. (4.19) 
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They satisfy 


1 
Pao) Ча v; ta) (Та | € 2) (| Te) ®| Ta) +] 12) 9 | L2)) 
(4.18),4.19) 
1 
= a Te) ые 12) +| Ta) nie S| La) 
1 
= Wi tz) 6| Ta) (4.20) 
and i 
P,,-1|®*) = —| 12) 8| Le) 
б (4.21) 
||P:+11®*) || = J e 


If Alice measures the observable o; in her sub-system and detects the value +1, 
then the composite system is—in accordance with the Projection Postulate3 in 
Sect. 2.3.] —after that measurement in the normalized composite state 


м2 


_ РФ) _ ([ТӘ)(1; 1®1)|Ф+ 
NL |I (i 12) (1% \®1)|Ф+) 


[F +1): = dg99|12. 422 


| (4.20),(4.21) 


This means that Bob’s system will be described by 


p? (I. 41) (%, 411) u^ (I5) 11) = шї (12) @| 12)(0219 (020) 


(3.56) (4.22) 
Z t^ (|12)(12 18] Te) (Т Pier us| Ta) (Ta DI Ta) (Ta | 
(3.36) e5) X 

= |[%)(1»|, 


which is the density operator of the pure state | 12). Hence, after a measurement 
of оу, in which Alice observes the value +1, Bob's system has to be in the state 
| 12). The value which would be observed if с; were measured by Bob on system B 
can then be predicted with certainty to be +1 without actually having to measure it. 
Analogously, if Alice measures o; on her qubit and observes the value — 1, then the 
composite system becomes 


81)|o*) _ 
exeo 


P. io^) (1 н) 


|Р. _1|Ф+)|| IK lot 
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In this case Bob's system has to be in the state | |2) and the value which would be 
observed if о; were measured by Bob on system В can be predicted with certainty 
to be —1 without actually having to measure it. Consequently, the spin in z-direction 
is an element of reality for Bob's qubit. 

If, however, Alice chooses instead to measure o; (rather than 0,) and observes the 
value +1, then according to the Projection Postulate 3 in Sect. 2.3.1 the composite 
system is after that measurement in the normalized composite state 


м2 


Рафт) _ ( Та) (Ts @1)|o* 
WP eit |0 Ts) (Ts |e1)je* 


| Tx) 9| Te). 


—— 


Ау 
(4.18) 


In this case Bob's qubit will be in the state | Tg), and the value of the spin in 
x-direction can be predicted with certainty to be +1 without the need to have it 
measured. Similarly, if Alice measures Oy and observes the value —1, then Bob's 
qubit after a measurement will be in the state | |5), and, likewise, we can predict 
with certainty that any measurement of the spin in x-direction on Bob's qubit will 
reveal the value —1. Thus, if Alice measures o; on her qubit, then for Bob's qubit 
the spin in x-direction is an element of reality. 

Regardless, in which direction Alice measures the spin of her qubit, the spin of 
Bob's qubit in the same direction can always be predicted with certainty without 
the need to measure it. This means that Alice's choice of the direction z or x for a 
spin-measurement on her qubit determines whether for Bob's qubit the spin in z- or 
x-direction is an element of its reality. 

This also holds when Alice and Bob are separated by such a distance and perform 
their measurements in a way that no signal from Alice traveling at the speed of light 
can reach Bob before he would perform his measurement. Since Alice is free to 
choose o; or Oy, and Bob's qubit cannot ‘know’ which direction Alice has chosen, 
both spin in z-direction and spin in x-direction are elements of reality for Bob's 
qubit and this is despite 0x0; 4 0;0;. 

The objection that Alice cannot measure oy and о; jointly sharply, but only ever 
one of them and thus for Bob's system only the spin in that same direction can 
be an element of reality and not both simultaneously is refuted by EPR with the 
argument that then the possible elements of reality of Bob's qubit are determined 
by Alice's choice even though no signal from Alice can reach Bob's qubit in time 
to communicate that choice. Regarding this EPR state: *no reasonable definition of 
reality can admit that’ [4]. 

If one accepts this last argument, then (4.15) would be proven and it were shown 
that quantum mechanics is not a complete description of the systems. One possi- 
bility could be that there are further variables that determine the behavior of the 
systems, but which are not revealed by the quantum mechanical description of the 
system by a state vector. These were called (local) hidden variables. 

But the incompleteness of quantum mechanics, that is, the existence of hidden 
variables, is not the only way out. Rather, all experiments to this date exhibit that 
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reality is—in the sense of EPR—‘unreasonable’. In our example this means that 
(local) measurements by Alice are indeed shown to have an immediate (in other 
words, faster than light) impact on Bob's system even though no detectable signal 
has been sent. This is commonly called quantum mechanical non-locality. 

The central role occupied in this context by BELL’s inequality is due to the fact 
that on the one hand this inequality is based on the assumption of hidden variables, 
whereas on the other hand a violation of this inequality is predicted by quantum 
mechanics for certain states. This opened up the possibility of an experimental test 
for the existence of hidden variables. 


4.5 BELL Inequality 


In an article, which at the time drew rather little attention, BELL [63] considered 
a pair of qubits in a composite entangled state |P} and assumed that there exist 
variables that determine the spin-observables of the qubits in any direction. From 
that he derived an inequality for the expectation values of the spin-observables in 
various directions. That is the BELL inequality, which we will first derive in the 
form originally given by BELL [63] and then in a more general form derived later 
by CLAUSER, HORNE, SHIMONY and HOLT (CHSH) [2]. Experiments have since 
shown that nature violates the BELL inequality [9]. More precisely, there exist entan- 
gled states, in which the expectation values of products of spin-observables (aka 
*spin-correlations") in certain directions violate the BELL inequality. This implies 
that the behavior of such systems is not determined by hidden local variables, since 
their existence is the starting assumption for the derivation of the BELL inequality. 


4.5.1 Original BELL Inequality 


Assuming the existence of hidden variables, which determine the observed values 
of spin-observables completely, is equivalent to assuming that the measured values 
have a joint distribution (see Appendix A). Essentially, the BELL inequality thus 
follows from the assumption, that the results of spin-measurements on two qubits 
can be represented as discrete random variables of a joint distribution. As we shall 
see, the BELL inequality is violated in certain entangled states. Consequently, the 
assumption of a joint distribution for spin values of two qubits in certain entangled 
states is invalid and thus also the equivalent assumption of hidden variables. 

The derivation originally given by BELL [63] for the inequality which now bears 
his name runs as follows. Consider a pair of qubits that have been prepared in the 
entangled BELL state 


142 4 Entanglement 


1 


~ V2 
(3.28) 


La) (101) - [10)) e n^ e w^, 


of which qubit A is sent to Alice and qubit B to Bob. Alice can perform a spin- 
measurement, in which she can arbitrarily select the direction in which she measures 
the spin of qubit A. This direction is represented by a unit vector in IR? as defined 
in (2.122) and given as 


sin Ө cos @ 
й = 1(0,ф) = | ѕіпӨѕіпф | € R^. 
cos Ө 


On her qubit A she thus measures the observable fi^ - с, that is, spin in the direction 
determined by the unit vector fi^. We denote this observable by 


XA-É.c (4.23) 
and the values observed when measuring it by Sea The sA, thus constitute a set of 
discrete random variables (see Appendix A) parametrized by й^ that сап only take 
values in {+1}. Similarly, Bob can measure the spin of his qubit B in a direction 


fi?, which he can select arbitrarily and independently of Alice. We denote his spin- 
observable by 


=i os (4.24) 


n 


Likewise, the values he observes when measuring х2, constitute discrete random 


variables, which we denote by 58р. These аге parametrized by fi? and can only take 
values in {-Е1}. 


Exercise 4.54 Let | Та) and | |а) be defined as in (2.125) and (2.126). Show that 


then 
1 


(42 


For a solution see Solution 4.54 


|У) (| Ta) 9| la) —| La) 8| Ta)) - (4.25) 


The quantum mechanical expectation value of the observable х4, rs х2, in the state 


|4) is given by the negative of the cosine of the angle between fi^ and fi?. This is 
to be shown in Exercise 4.55. 


Exercise 4.55 Show that for ХА, апа I as defined in (4.23) and (4.24) one has 


(А Ore) =—й“*.йЁ. (4.26) 
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For a solution see Solution 4.55 


In particular, it follows from (4.26) for measurements that Alice and Bob perform 


in the same direction й^ = f = f, that 


(Zi @ 2s )y- = –1. (4.27) 


Suppose now that the properties of each qubit are determined by a variable œ, the 
value of which we do not know, in other words, which is ‘hidden’. We may, however, 
assume that æ lies in a suitable set Q. Furthermore, we assume that the description 
of the qubits by о € Q is complete in the sense that the measured spin values 544 (œ) 


and 58, (@) in any directions f^ and й? are completely determined by the variable 
о. If Alice were to know for her qubit the value of œ, she would be able to deter- 
mine the function 5А (0) by sufficiently many measurements. The knowledge of 
that function would then enable her to predict the result of spin measurements on 
her qubit, given the knowledge of œ. The same applies for Bob. But the value of 
æ for a given qubit is not known, which is why they are called hidden variables. 
We can only assume that every value of œ € Q occurs with a certain probability 
0 € P(@) < 1 with the property 


P(Q) = | a) = 


Altogether this means that we assume that the observable spin measurement values 
SA and D" constitute discrete random variables on a probability space (Q,A,P) 
(see Appendix A), which are parametrized by unit vectors fi^ and fi?. These ran- 
dom variables do depend on the state in which the particles are prepared. For our 
considerations this is the state |). Since we consider Soa and D" as the values of 
observed spins for the particles in state |}, we also require that they satisfy the 
equivalent of (4.27), which means that for arbitrary fà 


E [sá5] =, py s1soP (5$ = s; and 52 = s2} 
(A.3) (81:92)Є1=1,+1) 


satisfies 


E [ssf] - -1. 
With these assumptions BELL then proves the following theorem. 
Theorem 4.5 Let Sa and am be two discrete random variables on a proba- 


bility space (Q, A,P) that are parametrized by unit vectors й € IR? and take 
values in {+1}, that is, 
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for X € {А,В}, (4.28) 


and which, in addition, satisfy for all à € 52, 
Е [5252] = –1. (4.29) 
Then for arbitrary unit vectors f! with i € {1,2,3} the BELL inequality 


rie] npe 


-E oes] <1 (4.30) 


holds. 


Proof From (4.28), (4.29) and (A.3) it follows that 
-1 = Е [5452 = P{s = 52} —P {sé = 52) =1-2P (s$ = si} 
—— 
-i-b(si- 50) 


and thus 
P(s$2—5$) = 1 (4.31) 


for arbitrary directions fi. Furthermore, we have then 


и ва] = elds] +e bs] ano 6-40) 


This implies the claimed inequality as follows: 


Еа) -Е| ө] - |Е[ф (ed -1] 
< Е (sts 1) | 
- в) 
du E [1—55 e E |1- s 4,] 
5А sA |=1 ws 51 
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Ау 
(4.31) 


Here we point out once more, that the the assumption, that there exist hidden 
variables, which determine the values of spin-observables in arbitrary directions, is 
equivalent to the assumption, that s4, and Se for arbitrary fi^ and fi? are random 
variables on the same probability space (Q,A,P) with a joint distribution. This 
means, in particular, that the spin-observables are determined by @ € Q, and that 
sets of the form {@ € О | 5А, (a) = a and 54, (0) = b} with (a,b) € {+1,+1} for 
arbitrary directions fi! and f? are measurable with the probability measure P. This 
latter property was essential for the proof as it has been used in deriving (4.29). 
Thus, if there exist hidden variables œ that determine the values of the spins Alice 
and Bob observe (and that make them simultaneous elements of reality for their 
particles), then the BELL inequality (4.30) has to hold. 

What then do we get, if we insert for the left side of the BELL inequality the 
quantum mechanical expectation values? With (4.26) and the choice 


[жеч 


І 5 0 
й = |01, №- [о |, &-[o (4.32) 
1 
0 + 1 
we obtain 
lex eX 30 — (z4 ев) |- (5h ez) 
= [а.а а.а] - à? i? 
1 1 
zd 0 +——=\/2> 1, 4.33 
| ; з din 


which means that the quantum mechanical description predicts for the state | V^) 
and the choice (4.32) of directions the violation of the BELL inequality. 

Which of the two possibilities (4.30) or (4.33) is then chosen by nature? The 
answer to that question was given by an experiment performed by ASPECT, DAL- 
IBARD and ROGER [9], which, however, used the CHSH-generalization of the BELL 
inequality. We shall thus first derive that generalization in Sect. 4.5.2 before we dis- 
cuss the experiment. 

But the answer to the question may be given here already: nature behaves in 
accordance with the quantum mechanical prediction. It violates the BELL inequality 
in states for which quantum mechanics predicts the violation. 
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The fact that in connection with the BELL inequality one often speaks of corre- 
lations is due to the following. The correlation of two random variables Z; and Z2 
is by Definition A.7 given as 


E[Z;Z)] —E[Z,| E [Z2] 


Jetzt] 047) (e-e) 


сог[21 Z] = 


For random variables Z; with i € {1,2} and the properties 


E[Z] -0 
E (4.34) 
it thus follows that 
сог[21,22] = E [Z122]. 
Exercise 4.56 Show that for arbitrary fi^ and ñ? 
(Zi 815) == (rozh) | (4.35) 
n y- n y- 


For a solution see Solution 4.56 


If we then require for 524 and 58, the equivalent of (4.35), that is, 
ров. 


then (4.34) is satisfied for the random variables 4 = sia and Z2 = 58р, апа we find 
indeed that 
cor[52,,555] = E ЕЕ . 


In view of (4.33) compared to (4.30) it is thus often said that ‘quantum correlations 
are stronger than classical correlations’. The correlations generated by entangled 
states are often called EPR-correlations. 


4.5.2 CHSH Generalization of the BELL Inequality 


Just as the original BELL inequality, the generalization derived by CLAUSER, 
HORNE, SIMONY and HOLT (CHSH) [2] also considers a pair of particles on which 
individual measurements yielding possible values in {+1} can be performed. The 
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CHSH generalization also provides an upper bound for expectation values of prod- 
ucts of observable single-particle measurements. The generalization is that, unlike 
in BELL’s original derivation, no requirement of the form (4.29) needs to be made. 

The CHSH variant of the inequality is based on a surprisingly simple result, 
which we prove as the following lemma. 


Lemma 4.6 Let s; with i € {1,...,4} be four discrete random variables on a 
probability space (Q,A,P) that can take only the values in {+1}, that is, 


Sj: Q — ЕЕ ; 
DERE Јогіє {1,...,4}. 
Then the following inequality holds 
[Е [5152] — E [153] + E [s254] + E [sas4]| € 2. (4.36) 


Proof Because we have for all œ € О and i € {1,...,4} 


si(@) € {+1}, 
it follows that either 
s2(@) —53(@) =0 => 52(@)+53(@) = +2 


or 


s2(@)+53(@)=0 => s2(@)—53(@) = +2, 


and, using again s;(@),s4(@) € {+1}, thus, 


s1(@) (s2(@) = 53(@)) + s4(@) (s2(@) +53(@)) mE. 
This implies 

|s1(@) (so (c) — зз(®)) + sa (c0) (s2(@) + 53 (e)) | < 2 
and it follows from Lemma A.6 that 


[E [155] — E [5153] + E [s284] + E [sss4]| = |E [s1 (52 — 53) + s4 (s2 + 53)]] <2. 


We apply Lemma 4.6 to random variables given by the results of measurements 
to obtain a generalization of the BELL inequality as follows. We consider again pairs 
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of particles of which one is accessible to Alice and the other to Bob. The observables 
they can measure on their respective particles are no longer restricted to observables 
identified by a direction fi in IR?. Rather, more generally, Alice can perform a mea- 
surement in which she can select the measurement device by selecting a (possibly 
multi-dimensional) parameter p^ from a set P of device-parameters. This means 


she measures an observable denoted by E the measured value of which we denote 


by Cun and which can take only values in {+1}. Similarly, Bob has at his disposal 
a measurement device, which he can adjust at his own choosing. The state of the 
measurement device is described by parameters р? € P, and the observable thus 
measured on his particle is denoted by 55. This observable can take only values in 


{+1} and the observed values are likewise denoted 52,. Suppose now that each par- 
ticle is described completely by a variable @ € О, which we do not know, in other 
words, which is hidden. Completeness of description means that the variable w € Q 
determines sA and spe- In other words, the values SA and 5рв measured for their 


respective device settings p^ and р? are assumed to be parametrized random vari- 
ables with a joint distribution on a probability space (Q,A,P). CHSH then prove 
the following Theorem. 


Theorem 4.7 Let s and ЗВ be two discrete random variables оп a prob- 
ability space (Q,A,P) that can take only values in {+1} and that are 
parametrized by a (possibly multi-dimensional) parameter p in a parameter 


set P, that is, 


бО) == {+1} 
(p, o) ж st (o)' forX € {А,В}. 

Then for arbitrary parameters рі,...,рд Є P the following generalization 

of the BELL inequality given by CLAUSER, HORNE, SHIMONY and HOLT 

(CHSH) holds: 


|Е [5.55] -Е [59,593] +E [spas] +E Е | <2. (4.37) 


Proof The claim (4.37) follows immediately from Lemma 4.6 by setting in (4.36) 
si = sp, for i € {1,4} and s; = s$, for i € (2,3). 


In the derivation of (4.37) the EPR-implication has been used that all observ- 
ables SX, for X € {A,B} and i € {1,...,4} are jointly elements of reality, in other 
words, that these observables for the considered particles always have one of the 
values from {+1} determined uniquely by a hidden variable œ, the value of which 


2This includes, but is not restricted to, a spin-measurement in which she can select the direction in 
which the spin is measured. 
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Fig. 4.1 Choice of directions f! for i € (1,..., 4) in the (x,z)-plane with (4.40) for spin- 


measurements used to test the CHSH variant of the BELL inequality 


is unknown to the observer. What then does quantum mechanics predict for the left 
side of (4.37)? For this we consider again two particles that are parts of an entan- 
gled BELL state |^) and as observables St the spin-observables defined in (4.23) 


and (4.24). In this case the parameters are again given by directions, that is, p; = fi! 
and we have 
50 =УХ — forX € {A,B} andi € (1,...,4). 


We choose directions in the (x, z)-plane 
| COS Vj 
à-| 0 | esh forie {1,...,4}, (4.38) 


sin Vi 


with angles v; yet to be selected. With the result (4.26) from Exercise 4.55 it then 
follows that 


A B A B A B A B 
(ха ozi) = (s ӘХ Ж + (s 9I»). + (s GI Dye 


= —cos(V; — v3) + cos(Vi — v3) — cos(V4 — V2) — cos(V4 — Уз). (4.39) 


With the choice of directions shown in Fig. 4.1 


Vi = — V= уз =0 Уд = (4.40) 


for the spin-measurements, this implies 


(А OER) = (à OIL). + A om) + (5 ex). = —2V2, 
(4.41) 
which is evidently contradicting (4.37)! 

Which of the two exclusive options (4.37) or (4.41) is then realized in nature? 
The answer to this question was given by the experiment conducted with photons by 
ASPECT, DALIBARD and ROGER [9], which is graphically summarized in Fig. 4.2. 
The answer is: nature behaves in accordance with (4.41) and violates the CHSH 
variant of the BELL inequality (4.37). In that experiment a source emits, by means 
of two successive transitions (aka cascade), two photons in an entangled state one 
of which is sent to Alice and the other to Bob. The time from emission to arrival at 
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Alice chooses Bob chooses 
XA XA 5 mh 
P S | 


1+1 —1+1 


=) 


Fig. 4.2 Schematic summary of the experiment by ASPECT, DALIBARD and ROGERS 


Coincidence filter 


either of them is 40 ns. During the time of travel of the photons Alice selects either 
the observable ХА, or X4, to be measured. The time needed to switch from one to 
the other is no more than 10 ns. Likewise, Bob selects, during the time the photons 
travel and independently from Alice, either the observable xD ог xb. Thus, the 
observables measured by Alice and Bob are determined after the photons have left 
the source. A coincidence filter is used to select only photons originating from the 
same cascade. This filter ensures that the photons selected and arriving at Alice and 
Bob each form part of the same entangled state. Finally, detectors register one of the 
two possible measurement values from {+1} for each of these photons. 

The measurement of many photons thus yields, for example, the fictitious results 
shown in Table 4.2. Let м” for i,j € {1,...,4} be the set of measurements, in 


which x and I? have been measured. Furthermore, let AD be the number of such 
measurements and let SE ) for X € {А,В} be the values observed in measurement 
le МАВ. We can then calculate the experimentally observed expectation values 


denoted by ХА X, as 
n п 


AX = — у, О): (4.42) 
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Table4.2 Fictitious results of a run of measurements of the experiment shown in Fig. 4.2 in which 
Alice measures one of the spins xA or УА, and Bob measures one of the spins x, or x, with the 


choice (4.38) and (4.40) of fi’ for i € {1,...,4}. For these fictitious results the left side of the CHSH 
inequality (4.37) yields a value close to —2.8 < —2. In other words, the measurement results are 
in good agreement with the quantum mechanical prediction (4.41). The gray cells indicate that the 
value of these respective observables for that pair of photons is not known and, in accordance with 
the rule of quantum mechanics, cannot be known sharply since ХА апа ХА with the choice of f 
are incompatible observables 


Particle-| Alice Bob Particle-| Alice Bob 
pair| observes | observes ir| observes | observes 


No. s, s4 58, 58, s4 sia 58, s? 


m 
OS} O} CO] FY DY] TY] BY] GW] ROY] Re 


— 
— 


=| =| =| = 
Uy} BY] wN 
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Inserting the expectation values ILES thus calculated as approximation of the 


quantum mechanical expectation values (24 ex) _ in the left side of (4.41) 


(approximately) confirms this equation and thus the quantum mechanical predic- 


tion. On the other hand, inserting the expectation values ЖА УВ, thus calculated in 


place of the classical expectation values E Е (which assume a joint distri- 


bution) in the left side of (4.37) shows that this BELL inequality is violated. The 
reader may check with the help of (4.42) that the left side of the CHSH variant of 
the BELL inequality (4.37) for the fictitious measurement values shown in Table 4.2 
does indeed yield approximately the value —2.8 « —2, in other words, that it agrees 
well with (4.41). 

The EPR-implication made by excluding “unreasonable behavior of reality’ that 
ХА апа УА, jointly constitute elements of reality would have as a consequence that 
one can fill in the gray cells in Table 4.2 of the measurement values with the only 
possible values from {+1}. But regardless of how we apply our own metaphorical 
‘gray cells’ to fill in the literal gray cells in Table 4.2 with values +1 or —1, we 
always find that the BELL inequality (4.37) is satisfied. 

Let us spell out the really baffling aspect once more: every measurement of ХХ 
for X € {A,B} and i € {1,...,4} yields a value in {-Е1}. Measurements of these 
observables never reveal a different value. It is thus ‘reasonable’ to assume that 
these observables always would have the value +1 or —1. Consequently, every pair 
of observables (54,8) for i,j € {1,...,4} would always have а pair of values 
in {+1,+1}. Precisely this, however, necessarily implies the validity of the CHSH 
version (4.37) of the BELL inequality. But, as we have shown in (4.41), this inequal- 
ity is violated by quantum mechanics. It is thus impossible, that УА апа УВ, jointly 
assume one of their possible values, which we always observe if we measure each 
particle alone. In other words: even though each of these observables can be mea- 
sured individually and each measurement yields a value in {+1}, both together 
cannot have these values at the same time. 

Finally, it is worth remarking that quantum mechanics predicts the violation 
of the BELL inequality only for entangled states and even then only for certain 
spin-directions. If, for example, in the state | V^) we choose to measure spins іп 
the directions fi? = f°, then the quantum mechanical prediction for the left side 
of (4.39) gives the value — V2, in other words, satisfies the CHSH version (4.37) 
of the BELL inequality. The quantum mechanical prediction of expectation values 
for spin-observables in separable (that is, non-entangled) states also always satisfies 
this inequality, as is shown in the following proposition. 


Proposition 4.8 In any separable state |p) & |у) € ША @ HP the expectation 
values of spin-observables XA c хв in arbitrary spin-directions f! with i € 
{1,...,4} satisfy the CHSH variant of the BELL inequality, that is, 
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A B A B A В A B 
e SÈ) oy (21925) poy + OR IR) „ + (ZOIR) | <2 


(4.43) 


gay 


holds. 


Proof Generally, the expectation values of products of observables M^ @ M? fac- 
torize in separable states |p) ® |у) € H^ 9 ЧЫЎ, that is, one has 


(М^ ам?) ву = (PO YIM  eMP(oev)) = (P8 v|M oe M^y) 
= (elM^ e) (wi M" v) 
(3.4) 
(м^) рМ?) у. (4.44) 


From (2.118) we know that an arbitrary state |p) € "Н can be given in the form 
|p) =e! cos B|0) + e” sin BI1). 


Moreover, from (2.125) we know that a spin-up state for a spin in the direction of 
ñ(0,¢) is given by 


~if Ө 19s 0 
| Taca,o)) ^ € ? cos 510) +e'? sin 71) 


such that we can write |p) with the help of a unit vector f? :— ñ(26, 5) in the 
form 


le) = e^? | tag rey) = е | Т). 


The same holds for |y} = e| Tav) with suitably chosen ô and f". 


Exercise 4.57 Show that 
(Zâ) ть) — fii. (4.45) 


For a solution see Solution 4.57 


Combining (4.44) with (4.45) and the fact that the complex phase-factor is irrelevant 
(see Definition 2.14 and subsequent paragraph), then yields, 


A B s A B = ai nO aj aw 
VIP = (24), (25), = (à n ) (à! n ) 
(4.44) (4.45) 
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Il 
=> 


IA 
=й 
= 

N 
= 
<= 
| 
=> 
„ә 
m 
5 


IA 
м 
=> 
N 
| 
=> 
sa 
— Rm 
=> 
Ss 
+ 


(4.46) 
For arbitrary х,у € R one has 


2f x yl if xy 20 
ы+ы=[Е if xy «0 


and thus 


| (6? а?) -Y| + | (6? +í?) -à "| 22max(|&? âY], ÂY} <2. (447) 


Inserting (4.47) into (4.46) then yields (4.43). 


4.6 Two Impossible Devices 


4.61 BELL Telephone 


The—according to EPR 'unreasonable' —behavior of quantum mechanics, in other 
words, the instantaneous effect on the reality of Bob's particle by measurements 
performed by Alice, has tempted some people to attempt to construct a means of 
super-luminal communication between Alice and Bob. However, as we now show, 
such a device, which has been termed BELL telephone, cannot be used to transmit 
information at all, not even slower than the speed of light. 

The BELL telephone is supposed to function as follows. Suppose Alice and 
Bob each have a particle which together are in the BELL state |^). As shown 
in Sect. 4.4 after (4.22), Alice can then, by measuring o; on her particle, project 
Bob's particle into |0) = | 12) or |1) = | |2). If, however, she measures оу, she then 
projects Bob's particle into the states |+) = | Tg) or |-) = | |x). Alice thus tries 
to send a message to Bob by using the protocol shown in Table 4.3. Depending on 
whether Bob's particle is in a state from {|0),|1)} or from {|+),|—)}, he is sup- 
posed to read out 0 or 1. As we now show, this attempt to transmit information does 
not work because after Alice's measurement Bob's particle is in a mixed state. This 
mixed state can be described using either |0) and |1) or |+) and |—), but, regardless 
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Table 4.3 Protocol for the BELL telephone 


Agreed bit value Alice measures Bob's qubit in the state 
0 С: 10) or |1) 
1 Ox |+) or |-) 


of which observable Alice measures and which pair we use for the description, the 
mixed state is always the same, and Bob cannot read what Alice wrote. 

Our considerations will be general in the sense that we do not restrict ourselves 
to the case of the observables о; and о; or a single qubit system only. We assume 
that Alice has control over a sub-system НА and Bob over a sub-system HP, each of 
which forms part of a composite system НА @ Н?. Furthermore, we assume Alice 
has two distinct observables M^ and M^ with purely discrete spectrum in her sub- 
system at her disposal, which she can choose to measure and with which she encodes 
the classical bits O and 1 that she wants to send to Bob. For example, the agreed 
communication protocol could be such that she encodes 0 by measuring M^ and 
encodes 1 by measuring M^. 

To keep the notation manageable, we assume that the eigenvalues A, Є С(М^) 
and Ag € c (M^) are all non-degenerate in H^. The following line of arguments will 
also be valid in case there are degenerate eigenvalues, only the notation will become 
unnecessarily cumbersome. 

There exists an ONB {|e,)} of НА consisting of eigenvectors |e;) € Eig(M^, Ла) 
as well as an ONB {|@,)} C H^ consisting of eigenvectors |@,) € Eig(M^ ‚Аа). From 
Exercise 2.15 we know that these ONBs are necessarily related to each other by a 
unitary transformation such that 


|да) = О ел) = Yea, [U e4) ea, ) = У Паја): (4.48) 


а ay 


where U € Ц(НА). 

For Bob's system let (|f;)) € Н” be an ONB in HË. From Proposition 3.2 we 
know that then the set of vectors {ел & fp) } as well as the set {|é,) & |f) ) each 
constitute an ONB in the HILBERT space H^ &IH? of the composite system. In 
HA @ H? the vectors |e, Q fp) are eigenvectors of the observable M^ & 1? and the 
vectors |21) & | fp) of the observable M^ @ 1, that is, we have 


(w^ 18) lea ® fo) = alea & fo) 


(й^ a1") le; Q fp) = Ale ® fo) 


such that o(M4 @ 15) = c (M^) as well as o(M^ & 1°) = o (M^). As an eigenvalue 
of the observable M^ & 18 € Bsa(H4 @ HF ) each of these eigenvalues is (dim Н?)- 
fold degenerate, that is, dimEig(M^ @ 17, Aa) = dimH. A general eigenstate of 
МА @ 18 is of the form 
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lea & P) =) osea 9 fo), 
b 


and similar statements hold for M4 @ 15. 
Let the composite system initially be prepared in the pure state 


|) = Y Flea ® fo) = Y 2.9 fo) (4.49) 
a,b a,b 


and the particles of sub-system НА be distributed to Alice and those of sub-system 
IH? to Bob. Alice would like to exploit the fact that each of them has a sub-system of 
the same composite system in order to send the classical bit 0 to Bob. To accomplish 
that, she measures the observable МА. For the composite system this is a measure- 
ment of the observable M^ @ 18. If A, is the observed value of this measurement, 
then (2.87) of the Projection Postulate tells us that after the measurement the com- 
posite system is in the state 

2OPpyb,, 


s «РФ a 4.50 
ir (pP) 90 


Pha 


where P}, = |e;) (e4| & 1? is the projector onto the eigenspace Eig(M^ @ 18,5) and 
py = |F) (| is the density operator of the original pure state (4.49). 

From (2.86) we see that he probability to observe A4, and thus to end up in the 
state p; , is given by tr (pP,,). For all who do not know the measured eigenvalue— 
and Bob is one of them—the composite system after Alice's measurement is then 
described by the mixed state p which is a statistical ensemble of states p}, each 
occurring with a probability tr (PPa); that is, 


p= ХР observe A pi, = Ут (pP,,) Pha S P Pu pyB, . (451) 
(2.86) (4.50) 


The mixed state, which describes Bob's sub-system after Alice's measurement of 
the observable M^, is given by the reduced density operator p? (p). 


Exercise 4.58 Show that the partial trace of p over НА, that is, the reduced density 
operator p?(p) describing the sub-system B, is given by 


př) = V S uum sth (4.52) 


bj,b, a 


For a solution see Solution 4.58 
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Now, in order to send the classical bit 1 to Bob, Alice measures the observable M^. 
With the same line of arguments as for M^, Bob's sub-system is then in the mixed 
state 


pe Y Fab, Faby fo (fol. (4.53) 


Ьу a 


From (4.48) and (4.49) it follows that 


Fab = у Оаа Tub (4.54) 
aj 
and thus 
у Tb, Faby = у Оаа, АР Uaa Fan =, уш аа| Už a Pab Pob 
a (4.54) P ,2 pons 2 


= у (U*U) aa V ibi Faba 
аро м 
=бауа| 


Уу Fav, Ean, (4.55) 


where the last equation follows from the unitarity of U. From (4.52) and (4.53) 
together with (4.55) it finally follows that 


that is, Bob’s sub-system is always in the same mixed state regardless of which 
observable Alice measures. This means that Bob cannot detect the difference 
between Alice’s choice of M4 in order to communicate 0 or M4 in order to send 
1. This constitutes proof of the following statement. 


Corollary 4.9 There is no BELL telephone. 


We illustrate this once more using the protocol given in Table 4.3 with the com- 
posite state |Ф +). How is Bob to read the message? He has to determine whether 
his particle is described by the states from {|0),|1)} or from {|+),|—)}. He can 
attempt to find this out by measuring о; or Ox on his particle. Suppose he measures 
on his particle the observable o; and observes the value +1. Can he deduce from 
that, that his particle was in the state |0) = | 12)? Obviously not, since the probabil- 
ity, to observe the value +1 when measuring 0;, is also different from zero in the 
states |--) and |—): 


(бө = 5 = Kol-)P. 
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Consequently, performing a measurement on his particle does not reveal to Bob in 
which state his particle was and which bit-value was sent by Alice. 

This conclusion would be invalid, if Bob were able to copy the state of his parti- 
cle, in other words, if he were able to do the following: from a particle given to him, 
which is in a state unknown to him, he is able to prepare many (at least two) particles 
in the same state. To see how this would work, suppose Alice has measured o;. Then 
Bob's qubit is either in the state |0} or |1). Suppose it is in the state |0). Bob then 
makes several copies of this state unknown to him. He measures o; in his copied 
states. Each time he observes the value +1. Now suppose Alice had measured Ox. 
Then Bob's qubit will be either in the state |--) or |—). Suppose it is in |+). Bob 
again makes multiple copies of his state. In each of his copied states he measures 
Oz. But now half of the results will be +1 and half will be —1. This is in contrast 
to the case where Alice had measured o; in which case Bob's observations of o; 
always yield exclusively 4-1 or exclusively —1. Hence, if Bob were able to copy 
the state unknown to him, he could deduce from the results of his measurements on 
the copies he has produced in which state his original particle was, and thus, which 
classical bit (see Table 4.3) Alice encoded. Consequently, a quantum-copier would 
allow the construction of a BELL telephone [68]. 

However, such a device to copy an unknown quantum state, which is called 
quantum-copier or cloner, cannot exist either, as we show in the next section. 


4.6.2 Perfect Quantum Copier 


The fact that a quantum-copier does not exist, or as formulated alternatively, that 
*qubits cannot be cloned’ [15], is due to the linear structure of the HILBERT space 
containing the state vectors. A quantum-copier for a system with state vectors in H 
is defined as follows. 


Definition 4.10 Given 


(i) an arbitrary state (the ‘original’) |w) € H to be copied and 
(ii) a state (the *white-page") |o) € H to emerge as a copy, 


a quantum-copier K is a linear transformation that leaves the original state 
|y) unchanged and transforms the white-page-state |@) such that it becomes 
the original state | y), that is, K is an operator that satisfies 


К: |y) 8 |o) = |у) & |w) (4.56) 


for arbitrary |y) € Н and a given fixed |o) € H. 
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An arbitrary number of copies can then be produced by multiple application of 
the copier. As we shall see, it is, however, straightforward to prove the following 
proposition, which states, that no such quantum-copier exists. This statement is also 
known as the Quantum No-Cloning Theorem. 


Proposition 4.11 (Quantum No-Cloning Theorem [15]) A quantum-copier 
cannot exist. 


Proof It suffices to consider qubits, that is, to consider the case H = “Н and the 
action of a quantum-copier on the qubit-states |0), |1) and 5 (|1) + [0)). Per defini- 
tion K has to satisfy 


К(10) & |) =, 0) 210) (4.57) 
(4.56) 
K(I &lo)) = |1) e[n) (4.58) 
(4.56) 
|1) + [0) _ ]0 l0) .. [D +10) 
«( Ji е) —. 5 @ um (4.59) 


As K is supposed to be linear, we find that in place of (4.59) instead K satisfies 


«(99 ьш) = к(75 (D 19) +5 0010) 
1 
= ——(К(|1)®|®)) 4- K(J0) ә[)) 
n^ al | 
= (el) +ine10) 
(4.57),(4.58) 
E П)+[0) _ |1) +10) 


v2 v2 


From this it follows that there is no device that can copy arbitrary qubits. Since 
qubits are particular quantum systems, the general statement in Proposition 4.11 
holds. 


It is worth noting that there can be devices that copy particular states as speci- 
fied in Definition 4.10. For example, the controlled NOT A! (X) defined in Fig. 5.5 
satisfies the requirements in (4.57) and (4.58), that is, clones the states |0) and |1). 
The Quantum No-Cloning Theorem only makes the statement that there is no device 
which does that for all states. 
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4.7 Further Reading 


The more historically minded reader may want to consult the original article by 
EINSTEIN, PODOLSKY and ROSEN [4], where the the paradox with the same name 
was first spelled out. Similarly, the original articles by BELL [8, 63] are a worth- 
while read for those who want to get to the origins of the inequalities bearing his 
name. They can also be found in the collection by BELL [44], which, in addition, 
covers a wide range of fundamental questions of quantum theory. 

The book by AUDRETSCH [69] serves as an introductory text on entanglement, 
which also includes many of its aspects related to quantum computing and quantum 
information. A highly mathematical and more geometrically inspired perspective 
on entanglement is given in the book by BENGTSSON and ZYCZKOWSKI [59]. The 
book by LALOE [45] offers a very good combination of addressing wider philo- 
sophical questions without abandoning a mathematical (formulaic) description, as 
so many other works in this context do. Apart from chapters on interpretations 
of quantum mechanics, EPR and BELL inequalities, it also covers entanglement 
together with its current role in quantum information. 


Chapter 5 A) 
Quantum Gates and Circuits шен 
for Elementary Calculations 


5.1 Classical Gates 


Before we turn to quantum gates, in other words, gates for qubits, we first consider 
the usual ‘classical’ gates. In a classical computer the processor essentially performs 
nothing more than a sequence of transformations of a classical state into another 


one: " т 


х f(z) 
This is what we will refer to as the classical computational process, which is real- 


ized with a concatenation of classical gates and circuits.! 


Definition 5.1 An (elementary) classical (logical-)gate g is defined as a map 


g: (01 — {0,1} 
хл) E— (ат л) 


We define an extended classical logical gate g as a map 


g: {0,1} ——{0,1}" 
(улл aae e aaa ea) 


a 


where each g; is an elementary gate. A classical gate g is called reversible if 
it is a bijection and thus invertible. 


'The underlying model of computation that we use throughout this book is the sequential model 
based on a TURING Machine [70]. 
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Fig. 5.1 Graphical Input Output 
representation of a generic 
classical gate € 10, 1p € {0, ү" 
X] — 
&1(Х1,...,Х) 
is Gate 82(Х1,...,Хп) 
symbol 
gn(xi, sus ‚Хп) 
Xn ———À 


Any operation of a classical computer is of the form (5.1), in other words, a trans- 
formation of classical bits from one state into another. Hence, a classical processor 
is nothing more than a physical implementation of an array of suitable universal 
classical logical gates or circuits. 

Usually, gates are represented by special graphical symbols of the form shown in 
Fig. 5.1. 

For the description of classical gates it is helpful to use the binary addition 
defined as follows. 


2 
Definition 5.2 For u,v € (0,1) we define the binary addition и Ф v as 


2 
иФу:= (и+у) mod2, (5.2) 


where the expression а mod n is defined in Appendix D. 


The most prominent examples of classical gates are: 


Classical NOT-gate 


NOT : {0,1} — {0,1} 


2 (5.3) 
ху к= NOT(xi):2 1 x 
The name arises from the usual association 0 — No — False and 1 — Yes — True 
and the effect of NOT as ‘negation’. 
Classical AND-gate 


AND: (0,1)? — {0,1} 


(x1,x2) I— AND(x;,x2) := хү (5.4) 
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Classical OR-gate 


OR: {0,1}2 — {0,1} 


2 2 
(x1,%2) — OR(x1, x2) = x1 B x2 Ф хх? 
Classical (exclusive Or) XOR-gate 


XOR: {0,1}? — {0,1} 
2 (5.5) 
(x1,x2) > XOR(x1,x2) := x1 Ф 


Classical TOFFOLI-gate 


TOF: {0,1} — {0,1} 
2 (5.6) 
(x1,32,x3) > TOF(x1,x2,x3) := (x1,32,x1x2 Ө хз) 


In the graphical representation of the TOFFOLI-gate in Fig. 5.2 large dots have been 
introduced as symbols for the conditional application of the connected operator. In 
general, in gate representations these large dots symbolize that the operators con- 
nected to them will only be applied if the value of the bit flowing through the dot 
is 1. Indeed, one can see from (5.6) or Fig. 5.2 that хз in the third channel changes 
only if x; = 1 as well as x? = 1 holds. 


NOT AND 
2 ui 
Xi —— — 10x X12 
хо J 
OR 
al 2 2 
xi Q х Ө ххэ 
x2 
TOFFOLI 
ХІ Ф ХІ 
X2 e X2 
A 2 
X3 cp хз Ф хх 


Fig. 5.2 Symbolic representation of the classical NOT-, AND-, OR- and TOFFOLI- gates 
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For the sake of completeness we also list here the ‘gates’ 
ID: {0,1} — {0,1} 


(xj) — D(x) :2 x1 
FALSE: {0,1} — {0,1} 
(x1) > FALSE(x1) := 0 
TRUE: {0,1} — {0,1} 
(xj) — TRUE(xi) := 1 
copy“) : (0,1) — {0,1}? 
(x1) — COPY(xi) :2 (xi,x1) ` 


(5.7) 


However, these are often not shown explicitly in listings of logical gates. Altogether 
there are four elementary gates of the form g : (0,1) — {0,1}, namely, ID, NOT, 
FALSE and TRUE. Elementary gates are combined in various ways to form logical 
circuits. 


Definition 5.3 We denote by 3|g1,..., ок] the set of all gates which can be 


constructed from 21,...,gx. This set is defined by the following construction 
rules: 
(i) the 2g1,...,2x are elements of this set, that is, 


8i,---,8k € F|g1,--.,8x] 


(1) padding operations of the form 


Poma UM — {0,1} 
Xp Xn) жыл (x1, eooXg- blieb Xn) 
which insert pre-determined bit values y;,...,y; € {0, 1} at pre-determined 


slots j1,...,j) € (L,...,n-- I) are elements of the set, that is, for any 
l,n € N, уџ,...,у € {0,1} and pairwise distinct j,,...,j) € (1,...,n4- 1) 


(n) 
Py, niu © 3[81,...,8к] 


(iii) restriction and/or re-ordering operations 


о: (01 — {0,1}! 


(5.8) 


(Xie d (Ойлоо) 


are elements of the set, that is, for any /,n € N, and pairwise distinct 
ЕЕ А 
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TUN = SAK exl 


(iv) compositions of elements of the set belong to the set, that is, for any 
hi : {0,1}" — {0, 1)" and M : {0,1}! — {0, 1)" we have that 


hy ho € F[gi,.--,8K] => hı oh» € F[g1,...,8K] 


(v) cartesian products of elements of the set belong to the set, that is, for 
any h : (0, 1" — (0, 1)" апак: {0,1}? — {0,1} we have that 


h,k € 3[gi,.... gx] => Еее О; 5 


where h x k : {0,1}"t? — {0,1}"+4 with 


К анор н) 
Е (h(x1,. E КОДУ U h(u,. EE oo Eps EE soon ibo E y K(Xn415- e osos) . 
A set G = {g1,...,g,} of classical gates is called universal if any gate g can 


be constructed with gates from G, that is, if for every gate g 


ceci for g1,...,g/ ЄС. 
When many (sometimes many millions) of gates are connected the resulting 


arrays are called classical digital logical circuits. 


If gates are built from another set, then any gates gates that can be built from the 
former can also be built from the latter. 


Lemma 5.4 For gates hj,...,hy,g1,...,gk we have 
hi,...,hr e 3|gi,.... gx] => ароз С 3 осоо] 
such that, in particular, 


ОЕ К [Гел eK 


Proof 'The stated inclusion is a direct consequence of Definition 5.3 since the oper- 
ations to build any element in 3[/h,..., hr] from the /1,..., hr are the same as to 
build any element in F[g1,...,gx] from its elements and since the /1,..., A; are 
members of this set. 
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Example 5.5 For (x1,x2,x3) € (0,1? we have 


(ID x ID x XOR) o (ID x ID x AND x ID) orf, 45 
o (COPY x COPY x ID) (x1,x2,x3) 


(5) 
(ID xID x XOR) o (ID x ID x AND x ID) OTT324,5 (x1,X1,X2,X2,X3) 


RN 


— 
— 


(ID x ID x XOR) o (ID x ID x AND x ID) (x1,32,1,32,3) 


m 
524 |! 
2 


(ID x ID x XOR) (x1,32,x1x2,33) 


© 
ъ\ Il 
5 


2 
= (x1,32,X132 Ө x3) 


= 
GAI 
£T 


= TOF(xi,x2,x3). 
(5.6) 


Hence 


TOF = (ID x ID x XOR) o (ID x ID x AND x ID) orf} „ уо (COPY x COPY x ID) 


and thus Definition 5.3 implies 


TOF є F[ID, AND, XOR, COPY]. 


Theorem 5.6 The classical TOFFOLI-gate is universal and reversible. 


Proof Since every gate g : (0,1)" — {0,1}” can be decomposed in m gates gj : 
{0,1}" — {0,1}, where j € {1,...,m}, it suffices to show universality only for a 
gate of the form f : (0,1)" — (0,1), which we shall do by induction in n. 

We begin with the initialization of the induction at n — 1. With the help of their 
gate definitions (5.3)-(5.7) one sees that ID, FALSE, TRUE and NOT can be repli- 
cated by the various channels of TOF as follows: 


ID(xi) 


| 


xi = ТОЁ (x1, 1, 1) = r® o TOF op!) , у(х) 


FALSE(x1) = 0 = TOF,(0,0,0) = rP оТОЕо р), 2301) 


701,4, 


NU _ @) (1) (5.9) 
TRUE(x1) = 1 = TOF, (1,0,0) = r® oTOF op} за) 


2 
NOT(x1) = 1 Ф xı = TOF3(1, 1,21) = r$? oTOF op}. (к). 
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Consequently, every gate f : {0,1} — {0,1} can be constructed with TOF. More- 
over, the following shows that we can also build AND, XOR, COPY ! and COPY? 
with TOF, that is, we have 


AND(x,x2) = хх = TOF; (x1 ,x2,0) = г) o TOF op?) (x1, x2) 

d (5.10) 
2 
XOR(x1,x2) = x1 Ф = TOFs(1,21,32) = r$? o TOF op} (1,32) 


and 


COPY" (ху) = (x1,x1) = (ТОЕ, (x1, 1,0), TOF; (1, 1,0)) 
З 1 

Ha o TOF opt. (xi) 

COPY) (x1, ...%n) = xoc 4n) 


= "3 » sop s SCOPE хх COPY (а): 


Hence, according to Definition 5.3, it follows that 
ID, FALSE, TRUE , NOT, AND, XOR, COPY" € 3(TOF]. (5.11) 


Turning to the inductive step from n — 1 to n, we suppose that TOF is universal for 
gates of the form g : (0,177! — (0,1). 
Let f : (0, 1)" — {0,1} be arbitrary. Then, for x, Є {0,1} define 


Sx, (xi. ** Ха) := f (x1, * -Xn- 158) 


and 


(х,о): xor( AND( go(21,---;4n-1); NOT(xn) ), um 
AND(gi(xi,...X4-1) | X ) Je | 


Due to the induction-assumption, go and gı can be built with TOF, and because 
of (5.9) and (5.10), we know that NOT, AND and XOR can be constructed with 
TOF. Altogether thus / in (5.12) can be built with TOF. At the same time we have 
h — f , since 


h(x1,..-.,Xn-1,0) = xor( AND( Во (нь) NOT(0) ) 
AND( gi(x1,--.,%-1), 0 ) ) 
= XOR( &0(Х1,...,Хл—1), 
0 ) 


= Во: ат) 
= /(х\,...,Хл—1,0) 
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hQns.. 31,1) = XOR( AND( go(xi,....35-1), NOT(1) ), 
AND( giu, 1) ) 


= XOR( 0, 

gii, xu) ) 
= &1(Х1,...,Хи—1) 
= f (1,---,%n-1,1). 


In other words, we have 
f = ХОК о (AND x AND) o ((go x NOT) x (g1 x ID)) o COPY") А 
and because of (5.11) and the induction-assumption go, 21 Є J[TOF], it follows from 


Definition 5.3 that f € J[TOF]. Consequently, TOF is universal. The invertibility of 
TOF follows from 


2 
TOF o TOF(x; ,x2,x3) TOF(x;,x2,x3 Ф x1x2) 


(5.6) 
2 2 
= (x1,%2,%3 © xix2 Ө хіх) 
(5.6) =0 
= (xi,x2,X3); 


which means that TOF is its own inverse gate and thus reversible. 


Theoretically, it would thus suffice to only build physical realizations of the TOF- 
FOLI gate. From them all possible classical gates can be constructed by suitable 
combination. But the physical realization with the help of TOFFOLI gates is not 
always the most efficient. Depending on the application, it can be more efficient to 
use special gates especially built for the intended purpose. 


5.0 Quantum Gates 


The underlying model of computation that we subscribe to for a quantum computer 
is akin to the classical sequential model based on a TURING Machine [70]. We 
will not go into the details of such a computational model here. For our purposes 
it suffices that, quite analogously to the classical computational process (5.1), we 
consider the quantum mechanical computational process to be a transformation of 
a state of n qubits to another such state. In the quantum mechanical case the states 
are no longer represented by elements in (0, 1)", but in the case of pure states are 
described by vectors in the HILBERT space Н! /O = H8” or, more generally, by 
density operators p € D(H! / e); In the computational process the linear structure 
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of the state space as well as the norm of the original state should be preserved. 
The latter so that total probability is conserved. From (2.37) we thus know that 
the purely quantum mechanical computational process without any measurement 
necessarily has to be a unitary transformation, that is, 


U:"H?"— 5H?" éeu(?"). (5.13) 


Physically, such unitary transformations are obtained by subjecting the system to 
a suitable Hamiltonian for an appropriate period of time, thus generating U as a 
solution to the initial value problem (2.71). 

The quantum computational process forms the core part of any quantum algo- 
rithm. However, in order to read out the result, a measurement of one or several 
observables becomes necessary. With measurement as part of the total process, the 
transition from initially prepared quantum state to the final measured stated ceases 
to be unitary. 

The qubits on which a quantum processor performs computational operations 
are called quantum register or simply q-register. Analogous to classical gates, 
we then consider quantum gates as maps on the state space of several qubits that 
preserve the linear structure (superposition) and the normalization to 1 (conservation 
of probability). We thus define them as follows. 


Definition 5.7 A quantum 7-gate is a unitary operator 
Ur THE е 


For n — 1 a gate U is called a unary quantum gate and for n — 2 a binary 
quantum gate. 


It should be noted that quantum gates are linear transformations on the state 
space. As such they are completely defined on the full space by specifying their 
action on a basis, and in such a basis they can be represented by a matrix. As usual in 
quantum computing, we choose for such a matrix representation the computational 
basis of the given spaces. 

Before we turn to quantum n-gates, we first consider the simpler cases of unary 
and binary quantum gates. For the general case of n-gates we will then show that 
these can be built from elementary unary and binary gates. 


5.2.1 Unary Quantum Gates 


According to Definition 5.7, unary quantum gates are unitary operators V : H — H. 
These can be represented in the standard basis { |0), |1) ) by unitary 2 x 2 matrices. In 
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Matrix in basis 


Name Symbol Operator 10,10] 
Identity -— —— 1 10 
01 


Phase-factor M(a) M(a) := ei*1 


Р(а) := 
Phase-shift P(a) 


or Q-NOT 


PAULI-Y Y Y := © 


( 

( 
mux Кор xea — (0) 

( 

( 


PAULI-Z Z Z i= © 
+ OxtOz d. Rd 
HADAMARD H Н:= PN /2 1-1 


Spin-rotation а: а г 6 : 
by angle a Dy (a) Dala) Ge isin ол. —isin (nx m) 


isin 9 (n, J-iny) cos $+isin $n, 


around fi a 

Arbi . voo Voi 
rbitrary V V unitary Vig Уп 

unary gate 


Not a gate, but a non-unitary 
Measurement Д A transformation of the input-state 
of observable A A to an eigenstate of A 

and delivery of measured value A 


Fig. 5.3 Unary quantum gates 


Fig. 5.3 we show a list of the most common unary quantum gates. The most promi- 
nent unary gates are summarized once more in the following separate itemization: 
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Quantum-NOT-gate This is the well known PAULI matrix 
X = Oy. 


In the literature on quantum computing the usage of the symbol X in place of оу 
has become common. We shall thus adopt this convention from now on. Because 
of 6, = оў and 6076, = (оу)? = 1, we know that X is unitary, and because of 


am- (0) )-() -» 
wn (t9) -Q) 


it is considered the analogue of the classical negation and thus termed as the 
quantum NOT gate. 
HADAMARD gate We have already come across ће HADAMARD gate 


«Ox tO; 


HU 


in Definition 2.38 as HADAMARD transformation. Some of its properties have 
been given in in Lemma 2.39. 

Representation of a rotation in R? by fias spin-rotation These operators are 
also known to us from Sect. 2.5. 


unm а 
—isin $ (n, + ілу) cos 9 --іѕіп Fn, 


быш = ехр(— Зао) = ( cos Š — isin $n; —isin$ (n, 
We remind the reader here once more that—as shown in Lemma 2.35—spin- 
rotations generate all unitary operators on "Н. 

Measurement As formulated in the Projection Postulate 3, a measurement of an 
observable A transforms a pure state |y) into an eigenstate of A belonging to 
the eigenvalue À that has been observed as a result of the measurement. This 
is an irreversible and thus non-unitary transformation. Hence, a measurement 
cannot be a gate as defined in Definition 5.7. Nevertheless, we have included 
measurements here because they are part of some circuits or protocols, such as 


dense quantum coding (see Sect. 6.2) or teleportation (see Sect. 6.3). 


5.2.2 Binary Quantum Gates 


Binary quantum gates are unitary operators U : "Н? — ‘H®?. In the computational 
basis [|0)?,|1)2,|2)2,|3)?) (see Definition 3.8 and Example 3.9) these are repre- 
sented by unitary 4 x 4 matrices. In Figs. 5.4 and 5.5 we show the most important 
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binary quantum gates. Apart form the matrix representations, we also see there that 
a binary gate U in general can be built in various ways from unary and other binary 
gates. The function of the gate, that is, the operator U, is, of course, always the 
same. But it my be that one of the possible ways to build the gate may be easier to 
implement physically or have other advantages in a given application. 

These figures also show the symbols commonly used in quantum computing for 
the respective gate. The fat dots e and circles © used in these figures symbolize the 
conditional application of the operators in different channels connected to them by 
lines. Those operators in a gate that are connected to a fat dot e will only be applied 
if the qubit going through the channel with the dot is in the state |1). The qubit in 
the channel with the dot is unaltered. In case the channel with the dot is traversed 
by a qubit in the state |0), the operator connected to the dot will not be applied, in 
other words, in this case nothing happens. Conversely, those operators which are 
connected to a circle С) are only applied if the qubit traversing the channel is in the 
state |0). Nothing happens if the channel with the circle is traversed by a qubit in 
the state |1). On linear combinations |y) = Wo|0) + үл |1) these gates act by linear 
continuation of their behavior on |0) and |1). 

A further notation used in the graphic representations is the usage of Ө for NOT, 
which is given by the operator X = оу. The notation A; (-) used in Figs. 5.4 and 5.5 
for the so-called controlled gates will be defined in Definition 5.10. 

It should be noted that in the graphic representation of gates the transformation 
effected by the gates is assumed to happen by the qubits traversing the gate from left 
to right, that is, the initial state enters on the left and the transformed state leaves 
on the right. This means that—in contrast to operator-products—the leftmost oper- 
ator shown in the graphic representation acts first and the rightmost operator in the 
graphic representation acts last on the traversing qubit. For example, in the case 
of the controlled U gate A'(U) the sequence of symbols in the graphic represen- 


tation | C X B-|X A | of this gate is exactly the reversed sequence of 
the operator-product (Р(о) &A)A ! (X) (16 B)A (X) (18 C) representing the very 
same gate. 

Every one of the three ways to represent a gate—by its graphical symbol, by 
its operator or by its matrix—has its advantages. Sometimes it can be helpful to 
represent a gate graphically in order to assist analysis and understanding of a circuit. 
Quite often the operator-representation is most suited for general proofs, whereas 
the matrix representation may be useful to elucidate proofs in special cases. 


5.2.3 General Quantum Gates 


As with classical gates, we combine elementary quantum gates to build ever larger 
quantum gates and eventually quantum circuits. 
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Matrix in computational basis 
(10)? = |00), |1)? = |01) 


Маше Symbol Operator |2)? = |10),|3)? = |11)} 
Controlled ————e— — . AMX) 1000 
NOT = 0100 
(С-МОТ) A \0)(0|@1 0001 
ЕВ 0010 
N 1) (1]@x 
—————e€ —— 
4 X L———— 


C-NOT with — — —(B—— AQ) 1000 


control in = 0001 
2. qbit 16 |0) (0| 0010 
+ 0100 

Хх @|1)(1| 


Controlled = АҢ(М(о)) 100 0 
phase- = 010 0 


multiplication M(a) |0)(0| @ 1 0 0 e'* 0 
NA 00 0 e@ 
[1)(1|®е!°1 
P(a)@1 


Fig. 5.4 Binary quantum gates (1/2). Some of the symbols are explained in more detail in 
Sect. 5.2.2 
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Matrix in computational basis 
{10}? = |00),|1)* = |01) 
Name Symbol Operator |2)? = |10), |3)? = |11)} 
C-NOT — O A(x) 0100 
controlled = 1000 
with |0) & [1)(1|®1 0010 
ES 0001 
10) (0| & X 
| (X &1)A' (X) (X &1) 
X 
Swap S 1000 
E 0010 
|00) (00| + |11) (11| 0100 
TE 0001 
101) (10| + |10) (01] 
X 
| | | A (X)A (X) A! (X) 
X X 
Controlled == АЧУ) 100 0 
Vy = 010 0 


|0)(0|®1 О О voo voi 
+ 00 vio у 


[D (eov 


(P(a) &A)A (X) (18 B)A! (X) (1&8 C) 


mit V = М(а)АХВХС 
und 1 — ABC 


Fig. 5.5 Binary quantum gates (2/2). Some of the symbols are explained in more detail in 


Sect. 5.2.2 
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Definition 5.8 For U; € ц(Н®”) withj € (1,..., K) we denote by 3[01,... 
Ux] the set of gates which can be constructed with the U;,..., Ux. This set is 
defined by the following rules: 


(i) 
U,,...,Uk € S|U1, ..., Ux] 


(ii) for any n € N 
e 3|U;,..., Ux] 


Gii) for any Vi, Vo € U(‘H®”) we have 


Vi, V2 € (Ui, ...,Ux] = Vi V € F[U1,...,UK] 


(iv) for any V; € U(H®”:) with i € {1,2} we have 


Vi, V2 € S[Ui, ...,Ux] = Vi @У» € S[Ui,...,Ux]. 


A set of quantum gates U = (U1,..., у } is called universal if any quantum 
gate U can be constructed with gates from U, that is, if for every quantum 
gate U 


U € S(U,,...,U;] for Uj,...,U; e U. 


When acting on a system in the state p € D(H) the gate U transforms it to a 
new state UpU*. 


Similarly to Lemma 5.4 in the classical case, we have the following obvious 
inclusion. 


Lemma 5.9 For gates Vi,..., Vr,Uj,..., Uy we have 


Vi,..., VE € SU1,... , Ux] => SH aeos Mi] € ПОРЕ 07) 


such that, in particular, 


АЦЕ 0 (5.14) 


Proof The stated inclusion is a direct consequence of Definition 5.7 since ће oper- 
ations to construct any element in F[Vj,...,Vz] from the Vj,..., V; are the same as 


to construct any element in 3|U,, ... , Uy] from its elements and since the Vj, ..., V, 
are members of this set. 
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Input Output 
c He” U є He” 
| Wn-1 ) | Фһ-1 ) 
® U3 ® 
® Ui & 
ү) (91) 
e U» e 
| Vo) фо) 


Fig. 5.6 Graphical representation of a generic quantum gate U, which can be built from the gates 
U,, U2, U3, that is, for which U € 3101,05, Оз] holds 


Figure 5.6 shows a schematic representation of a quantum gate which is built 
from three smaller gates. 

The result of the following Exercise 5.59 will allow us to define more general 
controlled gates. 


Exercise 5.59 Let n,na,np € No with n = na + m, and let |a) € "Н" and |b) є 
HS” be vectors in the respective computational basis. Moreover, let V € UH). 
Show that then 

1°"*! + la) (a| & (V — 1) 8 |b) (b| еН"). 


For a solution see Solution 5.59. 


Definition 5.10 Let n,na,np € No with n = na + nj and let |a) € 91%" and 
|b) € 191%" be vectors in the respective computational basis. Moreover, let 
V € UH). We denote the (|a), |P))-controlled V by AM (V) and define it as 
the n+ 1-gate 


Aly (V) := 19"*' + Ja) (a| e (V —1) 8 |b) (bj 


0 0 
= 1°14 Q layale(V-1)&e Q Ib) (dj. 
E ==! 


The qubit on which V acts is called target-qubit. In the special case а = 
2” — | and b = 2” — 1 one has |a) = |1...1)"« and |b) = |1...1)"^, and we 
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Exercise 5.60 Let V € U(*H) and o € R. Show that 


A! (V) = |0 (091+) (118 V (5.15) 
A(X) = io E (5.16) 
A'(M (a)) = P(a) & (5.17) 


For a solution see Solution 5.60. 


Proof From Lemma 2.34 and the accompanying proof we know already that for any 
unitary operator V on “Н there exist angles œ, D, y, ô, so that the operators 
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y op 
B:=D;( 2) pi ( 5 ) (5.20) 
С:= D} (22) 
satisfy 
ABC = 1 (5.21) 
V = ei*Ag,Bo,C. (5.22) 


In this we evidently have on account of (5.20) that 
A,B,C € S[Ds, D3], (5.23) 
and from (2.149) in Example 2.33 we see that 
X = ©, € F[M , Dy, D3]. (5.24) 
Together (5.22)-(5.24) thus imply 
V € F[M Dy, D3]. 
From (2.148) in Example 2.33 we also see that 
P(a) € F[M , Dy, D3]. (5.25) 
From (5.23) and (5.25) it follows thus that 
(Р(о) ®А)А!(Х) (18 B)JA (X) (18 C) € SM ,D;,D2,4'(X)]. (5.26) 
Finally, one has 


(Р(а) @A)A!(X) (18 
(P(a) @A)A!(X) (19 


JA (x) (18 C) 


B 
B)[|0)(0|&1--|D (11e X] (18 C) 


= (P(o)&4)[)(0|8 BC |1) 1] & XBXC] 
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P(a)|0) (0| & ABC + P(a)|l) (1l GAXBXC 
Mr ina ROME RR, 
=|0)(0, — «X еа) 
(5.21) 


[0)(0| @1+|1)(1| @e'“AXBXC = |0)(0191+|1) (19У 
< 
= у 
(5.22) 


— 1 
=_A!(V), (5.27) 
(5.15) 


and with (5.26) the claim (5.19) follows for A! (V). In order to proof it for A; (V), 
one exploits that from (2.150) in Example 2.33 it also follows that 
H € F|M ,Ds, Ds]. 
Because of (5.16), thus, 
A(X) € F[M, Dy, Dz, A (X)] 
holds and one verifies 


A\(V) = (A@P(@))A,(X) (B21)A,(X) (C@1) 


analogously to (5.27). 


We now show that A"(V), too, can be built from phase-multiplication, spin- 
rotation and controlled NOT. 


Lemma 5.12 For any operator V € U(*H) and number n € No we have 


A"(V) € F[M,Dy,Dz,A'(X)]. (5.28) 


Proof We show this by induction, which we start at n = 1. For n = 0 orn = 1 the 
claim is true on account of Theorem 5.11. For the inductive step from n — 1 to n 
suppose that A"! (V) € 3(M , Ds, D;, A! (X)] holds for arbitrary V € U(*H). 

First, we consider the gates A, B, C, D shown in Fig. 5.7. These satisfy A,C,D є 
S[A"-! (W)] with W = V/V, уу and B € F[A!(X)]. According to the inductive 
assumption one then also has 


A,B,C,D € 9|M Dj, Dj, A  (X)]. (5.29) 


The action of these gates and that of A"(V) can be described with the help of the 
computational basis |x) — e». xj) in SH®"*! as follows 
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input Аһу) D B C B A 
E —e— e 
@ 

\Xn—1) e Ф X 9 X 

e 

|Ххл—2) Ф Ф Ф Ф 
Q — 

e 

lxi) e e 9 e 
® 

Ixo) y E Ww vv 


Fig. 5.7 Generation of the controlled V gate A” (V) by A, C, D € S[A" ! (VV) , A"! (/V*)] and 
B € F[A} (X)]. Note that A"(V) acts on "IH?"*!, We point out once more here that in the graphical 
representation the leftmost gate is applied first and the rightmost last, so that the operator D of the 
leftmost gate appears on the right of the operator product and the operator A of the rightmost gate 
appears on the left of the operator product, that is, A” (V) = ABCBD holds 


D|x) = ха.) әу 19|) 
B|x) = |х, (х, т) а она ро) 
Сх) = хь.) Q VZT Y xo) 
А|х) = px,...x1) р" ШУ |хо) 
A" (V) |x) = |...) $ V= хо). 


This implies 


lqp14-1 ,. 
ABCBD|x) = ABCBl|x, ...xi) & V2Hi-i i |o) 


2 imp x: 
= ABC |х, (xa © хъ1)хь2...х1) D V2 71 7|xg) 
EROS П" 


2 P 
= AB|xn (xs Ф Xn—1)Xn—2---X1) @V 2 j-1 Л] хр) 


2 
2 хп 0n938 1) Pyn—2 


2 | 
= А|х, (x, D (Xn x4 1)) Xn-2---X1) У z j-1 9 xo) 
М 


—Xn-1 


Xn +Xn-1 = (Xn Ө Xn-1) 
= |x,...x1) QV 2 Ts 
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= |х, Já х) &ylli-is [xo) 
= A"(V) |x) 


and thus because of (5.29) 


A"(V) =ABCBD € [М ,Dy,D;,A'(X)]. 


We also need the following generalization of the swap gate S. 
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Definition 5.13 Forn c N andj,k € No with k <j < n— 1 we define on Н" 


Sf = 197-17 90) (0| e 19/-*-! e 0) (0| e 19* 
+ 18157 |) (91971 әәә 
+ 1971 ә |0)(1|®1®/—*—! ә [1)(0|@1®* 
+ 1?71798)(|e19 * eJoer?*. 


( 


It is useful to define as well 5." = 1*". The global swap or exchange oper- 


jj 
ator S? on 91" is defined as 


n-l-jj* 


s?;— [[ s? 
0 


(л) 


(5.30) 


With 5. the qubits in the factor-spaces "IH; and “Н inside the tensor products 


J 


‘H®” are swapped, that is, exchanged. With S (1) the sequence of factors in the tensor 


product is completely reversed. 


Exercise 5.61 Suppose n € N and j,k € No with k < j < п— 1 as well as 


Q, |vi) € HÈ”, Show that 


0 
SC Q Iy) = [nat Via Via s Vies Vi Va Wo) 
1=п—1 


n2 n 
(St) =1° 
[S50] =0 forj,k {т} 
0 п—1 
5) Q |w) = б) Iw) = yoyi.. ао). 
1-0 


l=n-1 


(5.31) 


(5.32) 
(5.33) 


(5.34) 
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For a solution see Solution 5.61. 


Example 5.14 As an example for swap operators we consider the case n = 3,j = 2 
and k = 0. Then one has [5] —120and $0) = 50). To illustrate the swap action, 
we apply se on |у) & |E) @|@) € ‘H®. For such a state we have 


lv) @|§) &|e) = (yol0) + үл |1)) & (&|0) + £i|1)) & (ф|0) +Ф1|1)) 
= уобофо |000) + vo5o€1|001) + дуобт 90/010) + обі 911011) 
+ 4и бофо|100) + үл боф1|101) + v16190]110) + үл &1ф1|111) 


(3) 


and for the swap operator a we find 


s = |0)(0]®1® |0) (0| + [1)(1|®1® |D (1| 
+ [0(1|®1® |1)(0|++ [1)(0|®1® |01]. 


This yields 


809) у) а |) ®|ф) = yoEoo|000) + yoEog|100) + дро 401010) + оёт ф1|110) 
+ wiFoo|001) + үл боф1|101) + үл &1ф|011) + wi di gi] 111) 
= (ф010) + ф111)) ® (8010) + €1|1)) ә (4010) + ул |1)) 
= |9) @|€) @|y). 


Next, we show that the gate Лз (У) can be built from gates of the form 4; (X), 
ЛХ) and A” + (у). 


Lemma 5.15 For any V € UH) and na,np € No we have 


INU ea ИЕ (5.35) 


and thus 
Aj (V) € 3|A (X) , A, (X) , A" "»(V)]. (5.36) 


Proof The identity claimed in (5.35) is illustrated graphically in Fig. 5.8. 
We use the abbreviation n = ng + n; in this proof. Per Definition 5.10 one has 
Af (V) = 19"? + [2% — 1) (2" — 1] @(V—1) @ 2” — 1) — 1] 


АУ) = 18"! + 2^ — 1(27—1| 8 (V — 1). 
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Input — A(V) Se etu аи 
[Xna +n) m n 
@ 
@ 
|+) | —9— Ф 
Ф 
|х) ү = Ж Ф X 
Ф 
|Хль„—1) —o— ° 
@ 
G9 
|хо) те X V X 
Fig. 5.8 Generation of a controlled V gate Aj? (V) from S, Va ++) and Anatno (V) 
Because of (5.32), this implies 
Soo ar SOS) = 19"* sto? от - ne" -11e v —1)]59у 7, 
and to prove (5.35) it suffices to show that 
|2" — 1) (27« — 1| (V — 1) & |2" — 1) (2"» — 1| 
= sr) [iz - 1)" Ца (У 2s | (5.37) 
For this we consider an arbitrary vector 
0 
G9 wj) = lyn.. wo) € HO"? 
j=n 
Then it follows that 
[[27« — 1) 2"« — 1] @(V—1) & [2^ — 1) 2^ — 1] ya... Wo) 
= |2”в — 1)(2”в — Wr... Wa—ng +1) (5.38) 
&(V —1)|w,,) & |2" — 1) (27^ — Ц, 1... wo). 
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Here we have n — ng = nj and 


па—1 
[2 — 1)(2" — 11v. Way tt) = | Q ID] 01... Ша. v) 
c ————— 
= ec 
c't na 
n ng—1 
=| Il < atw) [6919] (5.39) 
Ј=пь+1 
and, analogously, 
npy— 1 пр 
2» —1)(2%» — Цу 1... Vo) = [H п) 0 |. 640 
зат 


With (5.39) and (5.40) then (5.38) becomes 


[|2 — 1) (2" — 118 (V 1) e [2^ — 1) (2% — ҹи... Wo) 


= ом] Әә S (У —1)ю„)® [iu]. (5.41) 


j+ 
On the other hand, we have 
T (n+1) 
5б от = 1)(2"= ео (V-1)] sts" Iun. Wo) 


Шы ов ee ee 


= Suo? [27 — 1) ^ — у.з 1 -- Wt) C — 1|) 
MM 


- T o (lw) 


j+ 
-[II пи) [So [gie S (V= 9)lvs)] 
л 
пь—1 
-[П1‹ tv] Ф Inev- nw) e QI]. (5.42) 
20 I=n,+1 1=0 


From (5.41) and (5.42) follows (5.37) and thus the claim (5.35). From this in turn it 
follows that 


n п+1 п 
Ат (V) e 915% P A"(V)]. 
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Since a € 3[5] and S can be built from A! (X) and A,(X) (see Fig. 5.5), the 
claim (5. 7 follows. 


Definition 5.16 Let A be an operator on "Н. For vectors |b) of the computa- 
tional basis of "IH?" we define 


ASIB) . = А?л- 1@.. -QAP 


as well as 


| b) = | Ve осо by) = X |bn-1) &--- @X |bo), 


2 
where X = оу is the NOT-operator and ~b; :— 1 © b; is the classical negation. 


The general (|a), |b))-controlled n+ 1 gate Aly (V) can be built with the help of 
X as a function of the controlled gate A"(V). 


Lemma 5.17 Let па,пь € No and |a) € *H?"« and |b) € *IH?"^ vectors of the 
respective computational basis as well as V a unitary operator on ЎН. Then 
the following holds 


A) = (хе @1@x9™ Az) (xe ee xs) 


and thus la 
Ар) (V) € SEX Ang (У)]. (5.43) 


Proof For cj € {0,1} one has in general X © |с;) = |1) as well as (x79) aS 
1. Thus, one has for c € {a,b} the following identities: 
x ele) |с) == ce Qe exe) len i1) Q-Q |со) 
TOC enmi) es eX b] 


- Q |1) = |2" — 1) 


j=nc-1 
(xe? = 1°" 


XED [ое — 1) = |с). 
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With these we obtain 
(хее) & 19x99) An (V) (xea 2 18x2) 
= (Х®Г® g1ex9») 
ane + |2" — 1)(2" —1|8 (V 1) @|2" — 1) (2% — 11) 
(x2) @1вх®г®)) 
= (xe) әла (хе) 
——— ——— 


=1®ла —]98"p 


+ XEDD a _ -1xe9 
———M——— 


&(V — 1) 
Ca On aa 
QX eI) pn _ 1)(2" = 1|x e^» 
= 19"+%+1 ү |а) (a| & (V — 1) & |b) (b| 


la 
= Aly (V) , 


from which it follows that 


Aly (V) € SG Ane (V). 


Next, we show that every unitary operator U оп "IH?" can be written as a product 
of suitably embedded unitary operators V on ‘H. In order to do so we first define the 
necessary embedding operators Т. 


Definition 5.18 Let n,x,y € No with 0 € x < y < 2" as well as V be a unitary 
operator on H with the matrix representation 


y — ( 0 Уо! 
У10 Vil 
in the basis { |0), |1) }. With the help of the computational basis in ЎН” we 
define the operator Туу) (V) : "HI?" — "Н" as follows 
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Т (V) 
2n—] 


= Y |0) zl + voolx) Gd + vorlx) (yl + violy) (xl + vu ly) l (5.44) 
2=0 
29х,у 


= 1°" + (ию — 1) boy d void (re vio) Gl + (уп = Db О. 


In the computational basis 7) (V) has the matrix representation 


(0| (x| (| 
|0) f 1 
1 
k| -= —— —— v m —— —— va 
1 
Тууу) (V) = , 
1 
ee || —— —— —— vo —— —— — >п 
1 
1 
(5.45) 


where only the entries different from zero have been shown along with the bra- 
and ket-vectors to indicate the rows and columns of these non-zero elements in the 
matrix. 


Exercise 5.62 Let п, х,у and Тууу (-) be as defined in Definition 5.18. Show that 
for unitary operators У, И on ‘H the following holds 


Tij (V) Tij (W) = Tio, VW) (5.46) 
Туу (V) = Tuy (V*) (5.47) 
Ti (V) Typ; (V)* = 1°", (5.48) 


that is, Tj) (V) is unitary. 


For a solution see Solution 5.62. 


Before we come to the aforementioned representation of a unitary operator U on 
HE” with the help of suitably embedded operators on Н, we prove the following 
helpful intermediate result. 
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Proof In general one has 


N 
ОТ (У) = ( 2. Uia) (bl) 


a,b=0 


N 
(È I2 al + vool) (xl + vor lx) v1 viol) l vb) 61) 


z=0 


N 
= Y, usa) (5.50) 


N 
+}, (Yaxvoola) (x| + Ооо |а) (y| + Us viola) (xl + Ua vila) 1) 


а=0 
We now consider x = N — j and y = N and define 
UOS (5.51) 
TO := UU UT р (ym 


where we shall make a suitable choice for the operators V(N—). For this we consider 
the Nth row of the matrix (70) for which it follows from (5.50) that 
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QO = UU D Ty. jy i 


= 2 UU Pla) (b 


a=0 b= 


ON 
V (5-0, (NA), 0—1) 
+ у (О ee +UWy vig ја) (у — — j| 
a=0 
V (220-1, N) | 50-1), N) 
+ 2. —j Vol UU "Wn la) | 
a=0 


Hence, the matrix elements of 00) are 


(у (7—1 А x 
00-007  ifbg{N-jN} 


UD =й b ESSI E (5.52) 


~ 1) N 
d = 002), -j 7 a а n Л, 


To choose V (V7) suitably, we distinguish two cases: 
1. If Oye and ee both vanish, then due to (5.52) also Us and 00 vanish, 


and we choose VV) = 1. 
2. Otherwise, we set 
7107-1) 0—1) 
1 Оу Оу-у 
=1) 00-0 


yA) = 7 
e 2 xd 21 rU 
Vito of ee 06 


Then VN) is unitary, and one has 


rr) 170—1) AA) | pg U- D Wa) 
Ому; = Оуу 3700 d EN Vio ”=0 
p 0—1) 09-0) ц 0-1) (М 0 сар 099 
Оку = Оуу уо : +Unn Уң | = [|2 ah +|& | : 
Starting with j — 1 in either case we thus obtain successively 
Uf, =0  foje(L...,N). (5.54) 


For b € {0,...,N —j — 1) we have, because of (5.52) and (5.51), that 0 = Uyp. 
With this and (5.53) it follows that 
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р Ј 2 Ј 
3: ~(0 2 
OM = 4 Y 0 = йн. 
1-0 1-0 


Since U is assumed to be unitary, the squares of the absolute values in each row 
have to add up to one. Thus, we obtain finally 


N 


У |Unw-i|? = 1. (5.55) 
1-0 


bo 


Since UV) as a product of unitary operators has to be unitary, it follows that 


UM) = 18^ 


has to hold. This implies bo = --- = Ру— = 0, and thus that AU? is a 2^ — 1 = N- 
dimensional unitary matrix. Consequently, the matrix representation of U (№) = 000) 
is of ће claimed form (5.49). 


The claim of the following theorem appears to have been utilized in the context 
of quantum computing for the first time in [71]. 


Theorem 5.20 Let n € N and U be a unitary operator on "H9". Then there 
exist 2"—1(2" — 1) unitary operators W^?) on H with k € {1,...,2" – 1} 
andj € {1,...,k} such that 


a1 к | 
к= 0 (ican (wir) ) (5.56) 


J 


and thus 
Uc FIT oly) (v)] (5.57) 


for a suitably chosen V. 
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Proof Let N — 2" — 1. From Lemma 5.19 we know that there exist unitary operators 
VJ) € (Н) such that 


We can now multiply U) with TN -2)N -1) ee?) -« Tioyw-1) (И) 
from the right and choose the V - I.N =2) ono VCI according to the construction 


in the proof of Lemma 5.19 such that 


1 

N-1 N N—-1j-1 

аа П Ti-ow-n De 
JN 


has the matrix representation 


00 
AUC 23 

pug ool: (5.58) 
0 з. 010 
0 +. 001 


where A-D is a unitary N — 1 x N — 1 matrix. In arriving at (5.58) it has also been 


used that—as can be seen from the matrix representation (5.45) of the Tii. 1; ()— 
the multiplication of these with U (N) leaves the last row and column of U) 
unchanged. We continue these multiplications and, starting with / = М and counting 


down until / = 2, successively build the sequence of operators 


1 
00 =y HDT. y (Lj-1) 
I j-p (VO) 


which have the matrix representations 
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UO = | (5.59) 


The AČ in (5.59) are always unitary / x / matrices. Consequently, AO in UO isa 
2 x 2 matrix. In order to calculate UU we thus set V9 = A)*, Then we have 


1 1 
19" =U) = VT (VO) == (r-o (ие) ‚ (5.60) 
i-N (j= 


Solving (5.60) for U yields 


ч 1 2503] 
aic С N _ е ) Lan tn р), 


Example 5.21 As an example we consider the unitary operator U € HS? with the 
following matrix representation in the computational basis 


11 1 1 
l|li —1—1 
da (P 1 1 
1 —i —1 i 


This yields the following operators үү ®*—7; 
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En 2 d 3 
wen-[ s wen js к [л = 
к d]: i 2 i 1 v3 
у V2 BZ V3 2 2 
HL /3 3st 2 1 
wn (“Ay йя) weon [уз у 
4 4 Е 
V3 3 


The claim (5.56) can then be verified by explicit calculation, which is left to the 
reader. 


Next, we show that any Тууу (V) can be built from gates of the form Ар (w). 
For this we require the construction of a sequence, which is based on the so-called 
GRAY-Code. This is a sequence of vectors in "IH?" the consecutive elements of 
which differ only in one qubit. We formalize this in the following definition. 


Definition 5.22 Let n € N and x,y € No with 0 € x « y « 2". Moreover, 
let |x) and |y) be the corresponding vectors of the computational basis of 
1Н®”. A GRAY-coded transition from |x) to |у) is defined as a finite sequence 


of vectors |g°),...,|g*!) of the computational basis having the following 
properties. 
(i) 
le?) = |x) 
lg) = |). 


Gi) ЕогаП Г € {1,...,K +1} there exist none No with ny +ny Dem 
and лы Æ ny for all / Z j such that 


lg) = 12" QX Q12» |g!) 
and x 
(g^) 


к) С (5.61) 


прК+1 


(5 
With the help of |g!) we also define for l € {1,...,K +1} 


I о 1—1 11 
gsm IE 1 8na) € HE” 


, 3 (5.62) 
|) = las 1-а ) e Ho. 
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In the GRAY-coded transition thus defined two consecutive elements |g!~!) and 
|g!) only differ in the qubit in the factor-space "He, , (see (3.21)) of H®” 


[e = 1°! GXG 18^ [6/—1) 
= (e Ducis (e Dua Dau (811) sss (99). 
Moreover, from ny Æ ny for all 1 Æ j it follows that |g ^^) A |g’) if k > 1. 


GRAY-coded transitions are not unique. Between two vectors |х) and |y) there 
can be several such transitions. 


Example 5.23 We consider the case n — 3 and x — 1 and y — 6. Then one possible 
GRAY-coded transition is 


lx) = |1)° = 1001) 
lg!) = I5 = 101) 
5.63 
162) = 14)? = 100) ia 
b) = 1? = [110), 


that is, here one has nj: = 2, п = О and np = 1. 
An alternative GRAY-coded transition is 


|x) = |D)? = |001) 
|81) = |0)? = |000) 
|82) = |4?? = |100) 
|у) = 16)? = |110), 


where опе has пи = 0, по = 2 and n,3 = 1. 
The following transition 


x) = |D? = |001) 
|) = |5)? = |101) 
Is) = |n? = |11) 

у) = |7}? = |110) 


also changes in only one qubit in the step from from |g!) to |g’), but the step 
from |g?) to |y) does not satisfy the condition (5.61). As we shall see, this condition 
simplifies the generation of the Tj, (V) with the help of controlled gates of the 


form AT (V). 


In Exercise 5.63 we show that for any 0 € x « y « 2" there always exists a GRAY- 
coded transition from |x) to |y). 
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Exercise 5.63 Let n € N and x, y € No with 0 < x < y < 2". Show that there exists 
a GRAY-coded transition from |x) to |y). 


For a solution see Solution 5.63. 


Before we can prove the universality of the set U = (M D$, D;, A! (X)) of gates 
we still need the following intermediate result. 


Theorem 5.24 Letn € N and x,y € No with 0 € x < y < 2" and let |x) and |y) 
be the corresponding vectors of the computational basis in ЧН". Moreover, 
let V be a unitary operator on ЎН. Then every GRAY-coded transition |8!) 
with | € {0,...,K +1} from |x) to |y) satisfies 


1 
AX) ы lle e + He) "| (5.64) 
Du 
[^Ш 
Ti (V) = Аркы (V) (5.65) 
EM la) 
Tg- (V) = Аш; (X) Tn (V) Anny (X) (5.66) 
EC dd К+! U d 
Тр (V) = (Tay) a) Аркы) QU) (ПА? œ) . (5.67) 


Proof We start with the proof of (5.64). Per Definition 5.10 we have 


Al QC) = yong 0y +1 4 la) (a! | (X а 1)® \b!) (b! |. 
With n = n, +n, + 1 and 
X 1-0] [00] — ]0)(0] - | 1] 


one has 


196 5 Quantum Gates and Circuits for Elementary Calculations 


Ab (x) = 1°" + Ja’) 1e (10) Q1 + 11) 01) I| 
= |811) (e! |-- 19) (g^! | 
—|a^) (a! | & (10) 0] + |1) (1]) @ |B‘) (Ы 


= |811) (g/l |g!) (!| 
2-1 
= У heelt e] - |67) (a ||. 


fgg) 
For the proof of (5.65) one exploits that from (5.61)-(5.62) it follows that 


la+!) 810) ә |68) 
lg.) = [а en ep.) = |y). 


With Definition 5.18 we then find 


Такуу) (У) = 19" + (voo — 1)[g*) (g^ | voile (y| +violy) (e| + (vii = Dl 

= 18” 

+ (voo = 1 (laK*') ® |0) e [bX +") (а @ (0| (+1) 

vo (01) 0) ә p*)) (аә (1 @ OE") 

+ v19(laX*!) ә |1) 8 B®) (Каа (0e (ЕЦ) 

t (1-10) (8+1) ә) e [pK**) (ае (цә (p) 
ee 
(3.36) 


+ (voo — D)a*) (a® а |0) (0 [p ) (OA 
voa +!) (a | |0)(1] @ | (БК 
viola. 1) (а е |1) (0| |Б) (DE 


+ (ип = 0181) (а әу p) К+ | 
E 18” 


+|аК+!)(аК+1|® ((voo — 1)10) (01 + vo110) (1 
iol] + (i = DID (11) e |687) (f? 
= 1®"+|аК+1)(аЁ+1| ® (y —1) ә [pF (pF | 


|a?! 


Alpx+1) (V) d 


In order to prove (5.66), we use (5.64), and with Definition 5.18 one then obtains 


а!) 
Тр) (V) Ain (X) 
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= ( У, l+ voole’) (e'l + vorle’) or + vob te! vip 


Pi 

«( X nee hel + lee") 
гёк!!! 

= Y 2+1) (8 

Fr 

+voolg’) (e + voi") y] + viol) (e | + vul) ol 


and thus 
ak (X) Т еур) (V) Al) (X ) 
= ( E mete wee) 


+voolg’) (e | + voile’) (| + viol) (6 | + vily) ol) 
= У | (|+ уюн 1) (8/11 voal y] + violy) (€! |-- vul) 6l 


Lastly, we turn to the proof of (5.67). This is accomplished with the help of (5.65) 
and (5.66) as follows: 


la!) |аК+1)у la’) " la’) le 
Паў (X) Apr 1) (V) Цай (X ) esf II^; Г) (X ) Tgk) )|у) (У) ЦА 
E 65.65) ‘=! 
< |a! dix І ie 
= TT Aya ) Ti ety q) [I Ap) 00 
(5.66) ‘— um 


= Ар у уу (V ale X ) 


= Tap (У) = Tip (У), 


where we used in the last equation that |x) = |g?) holds. 
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Example 5.25 As in Example 5.23 we consider the case n = 3 and x = 1 and y= 3 
with the GRAY-coded transition (5.63), that is, K — 2 and 


|x) = [g?) = |1)? = |001) = |0) & |01) 
g') = |5? = |101) = |1) @ |01) 
Ww 
=) 
g^) = 4)? = |100) = |10) 90) 
м 
=ļa?) 
|у) = |g?) = |6)? = |110) = |1) ®[1)® |0) . 


Then one has at first 


о af Qj GI (4 Gl $e (Cl 


0) /1 
1) voo Vol 
2) 1 
_ |3) 1 
Tijg (V) = 4) 1 
5) 1 
6) vio vir 
7) 1 


where—in order to improve readability—we have indicated once more, by showing 
la) = |a)? in the rows and (b| = *(b| in the columns, to which |a) (b| the matrix 
elements belong. Furthermore, one has 


Ap (X) = 1®+(Х—1)®[0)(0|® |1)(1| 
1 


- 183 AE. 


ЕЕ 
ле eet) 
Gis) 


(3.35) 
0000 
—1 1 0100 
@3 
1 +| 1 1) ® [оооо 
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(| | Qj GI 4 6 (el 
0) 
1) -1 1 
2) 
EI 
(3.35) 5) 1 —1 
6) 
7) 
(| шоа (| d (| (e | 
0) / 1 
1) 1 
2) 1 
_ |3) 1 
= 1 
5) 1 
6) 1 
7) 1 
Analogously, one finds 
(| aj 2 GI (4 Ol (6 (7 
0) / 1 
1) 1 
2) 1 
5) 1 
6) 1 
7) 1 
(| пр 2 | (4 S de (7 
0)/1 
1) 1 
2) 1 
la?) 3) 1 
Ар) (У) = 4) voo vor 
5) 1 
6) vio Уп 
7) 1 
The reader is invited to verify (5.67) for 
Тө V) = Ag OAP GO AI (V) AP (X) Ayn (X) 


(7| 
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by explicit multiplication. 


With this latest result (5.67) from Theorem 5.24 we can now finally prove the previ- 
ously announced universality of phase-multiplication, spin-rotation, and controlled 
NOT. 


Theorem 5.26 The set of quantum gates U = (M , Dg, D, A (X)) is univer- 
sal, that is, for any n € N and U € UHS”) 


U € [М ,Dg,D;, A (X)]. 
meaning that any quantum gate U € UH”) can be built with elements from 
U. 
Proof We prove the claim with the help of the preceding results 
U € FIT ууу (V)] (5.68) 
Туу) (V) € 4/9 (у) (5.69) 
Al? (у) є F(X AM (V)] 
Any (У) € FIA (X), A QO ,A™*"5(V)] 
(5.36) 


X,V, A(V), A" (V) = F[M , D, D;, A (X)]. (5.70) 
(5.18),(5.19),(5.28) 


With these one has 


U € [Tio (V)] 


(5.68) 
Єл) CO 
(5.69) 
є ,31313191м Ds, Ds, A' (X J]] 
(5.70) 

€ FM ,D5,Dz,A'(X)]. 
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The importance of Theorem 5.26 lies in the fact that in principle only the gates 
M ,Dg,D; and A ! (X) need to be implemented physically in sufficient numbers. АП 
other gates can then be built by suitably combining them. Such constructions of 
general gates, however, are not necessarily the most efficient ones. Theorem 5.26 
only states that the unary gates phase-multiplication and spin-rotation and the one 
binary gate controlled NOT suffice to build any gate of arbitrary dimension. 


5.3 Quantum Circuits 


Gates perform elementary transformations. In order to execute more sophisticated 
applications one has to connect a large number of such elementary gates. Such 
constructions are called circuits. Similarly to the classical case, we thus denote a 
combination of quantum gates in order to perform certain transformations on an 
input/output register Н//О = ЎН®" as a quantum circuit. We will use the following 
three labels for the respective types of circuits: 


Plain circuits These are just compositions of quantum gates. 

Circuits with ancillas In these the input/output register H//? is first enlarged to a 
bigger composite system by adding an auxiliary quantum system (the ‘ancilla’). 
Then a plain circuit is applied to the enlarged system and at the end the ancilla 
is discarded and only the original system is processed further. Unlike in the case 
of classical circuits, we have to ensure that before discarding the ancilla any 
possible entanglement with it has to be reversed, that is, disentangled. 

Circuits with classical in/output and/or measurements In these the quantum 
system is manipulated depending on classical input, possibly subject to a mea- 
surement and delivering partly classical output. In general, however, these are 
non-reversible transformations of the system. 


In what follows we will give more formal definitions of the first two types of circuits. 
To define circuits with classical in- and output or measurements in a general and 
formal fashion is quite cumbersome and we shall refrain from doing so here. 


Definition 5.27 (Plain quantum circuit) Let n, L € N and Ui, ..., Ur € UHS”) 
be a set of quantum n-gates as defined in Definition 5.7. We call 


U-U,..U, eU(tH?") 


a plain quantum circuit constructed from the gates U,,..., Ur and L € N the 
length or depth of the circuit relative to the gate set {U),...,Uz}. 

When acting on a system in the state p € D(H) the plain circuit U trans- 
forms it to a new state UpU*. 
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Note that with our Definition 5.7 of gates we need to specify the set of gates in 
order to have a meaningful notion of circuit length. This is because we may just as 
well declare U; = U5U; as a gate and thereby reduce the length. Hence, whenever 
we speak of the length of a circuit, it is understood with respect to a given gate set. 

Because of (2.89) the action of a plain circuit U on a pure state |^) is, of course, 
just |V) — |Р). 

Before we can define quantum circuits with ancillas, we need to prove certain 
properties of that construction involving the input/output and auxiliary HILBERT 
space. We formalize this in the following theorem. 


Theorem 5.28 Let H!/° and H be HILBERT spaces and let |o), cy) € HY 
be such that ||@;|| = 1 = || ey | | Moreover, let Ü € щ(Н!/° SH) be such that 
for all |) c H!/° 

O|¥ & ex) = (U|V)) & lær) (5.71) 


and let po, = |o) (6| be the density operator of the pure state |o) € Н“. 
Then U € U(H! / 2 and we have for any density operator p € D(H! / 9) 
that 
p Spa, € p(m" 0g н”) (5.72) 


as well as 
i (Û (P pa Uy = UpU*, (5.73) 


that is, U is unitary and in a state Û (p [s Po) Ü* of the composite system the 
sub-system I/O is described by the state UpU*. 


Proof We show the unitarity of U first. Since |@;) and |оу) are normalized to 1, one 
has for arbitrary |Ҹ) c H//O 


IIUI? = (ООУ) = (UP|UP) (oy |oy) 
= 


e 


— 
N 
Ur 

— 


=1 
(UP) & oy (UV) ® oy), = ХОР ә о) 013 ә @;)) 
(5.71) 


— 
(3 


=, ПАВ о). = Л oill? 
2.5 


2 
= mI 


US 
ES 
= 


2 
ФС Lexi] 
SY" 


Ww 
2.5),(3.4) =| 


(2.37) (2.5 


— 
— 


Hence, for all |P} є H// then ||U*P|| = ||‘¥|| holds and from (2.37) it follows that 
U e u(g/?). 
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Let now p € D(H//9) and po, = |@;)(@;| € D(H”). Then (4.1) implies (5.72). 
Moreover, we know from Theorem 2.24 that there exist p; € [0,1] and an ONB |¥%) 


in H//? such that 
p = Yi) Hl. 


j 
Consequently, we have 


бары” = 0 (Zame tae 


J 


= Урд (Н) o) (n) 0" 


(3.36) 
Using 
(09 010* = (OG 90| = (О) 8 al = (О («| 
(2.33) (5.71) (3.15) 
= АИО & (ay| 
(2.33) 


and (5.71) in (5.75) we obtain 


Ü(p&pa)Ü* =, Ypj(Ul%) lay) ((H|U* & (arl) 
(5.71),(5.76) 7 
=, Урі) EIU e ler) (| 
(336 7 
- v (Speen) ureter 
j 
=, UpU*G|ey)(oy| 
(5.77) 
such that finally 
W (yj ^y wW * 
tr" (0(р®рь)0*) = t" (UpU* &|oy)(oy|) 
(5.77) 


= tr (lor) (a|) UpU* = UpU" , 
(3.57) 


where we used that 


(5.74) 


(5.75) 


(5.76) 


(5.77) 
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tr (loy) (ау) = Y eile) (ele), = Eelo? — llel? = 
(2.57) 7 (21) J (2.12) 


in the last equation. 


Note that the left side of (5.73) is the environmental representation of a trace- 
preserving quantum operation (see Definition 3.26). In some instances we utilize 
the ‘environment’ in the form of an additional quantum register, which helps us to 
build a circuit that is supposed to implement a given U € цн’ / s The auxiliary 
register is what has become known as ancilla and we extend our definition of quan- 
tum circuits to include such constructions. 


Definition 5.29 (Quantum circuit with ancilla) Let H!/° = *H$" and HY = 
"H9". A circuit U on H!/° is said to be a circuit with ancilla or said to be 
implemented with ancilla |@;) in an auxiliary (or ancilla) register H if 
there exist states |00), |y) € H” and a plain circuit О € U(*H?"*") on the 
composite system IH//? c HV such that for all |P) є H!/° 


O|Y о) = (U|V)) & |o) (5.78) 


holds. The length of U with respect to a given gate set is defined as the length 
of the plain circuit Ü defined in Definition 5.27. 

When acting on a system in the state p € D(H! / d the circuit U transforms 
it to a new state UpU* = tr" (Ü(p & pa,)U*). 


Any plain circuit U € цн” / 9) as defined in Definition 5.27 can be implemented 
with ancilla by simply taking Ü = U &1€ U(H! je S&H”). In this sense circuits 
with ancillas are a superset of plain circuits. We will, however, reserve the term 
‘circuit with ancilla’ for those circuits that satisfy (5.78) but are not of the simple 
form Ü = U 81. 

Ancilla registers are, as their name indicates, registers HW in which intermittent 
information is stored within a circuit, recalled and processed, but is not read at the 
end of the computation. The computation, that is, the circuit, may be performed by 
applying intermediate gates subsequently. During this intermediate computational 
process, in general, the states in the ancilla register become entangled with the states 
in the input or output register. A measurement of the ancilla register at that inter- 
mediate stage would thus affect the state in the input or output register. Such a 
measurement of the ancilla register would be necessary to reset it to a known initial 
state.? In order to avoid that resetting the ancilla register affects the output register, 
any entanglement between them has to be removed by suitable transformations. In 
doing so, the desired effect of the circuit should not be altered. In other words, we 


?For example, in order to reset the ancilla register in the state |0) one would measure 6; on each 
qubit and apply X , if the observed value was —1. 
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have to disentangle the ancilla from the input/output register without changing the 
latter. The circuit for the quantum adder discussed in Sect. 5.5.1 is a first example of 
such a construction. 

In Definition 5.29 the ancilla state |@;) is a fixed initial state and |@,) is a fixed 
final state of the auxiliary register. Often they are both chosen to be |0)”, but they 
do not have to be identical. They could always be made to coincide by a suitable 
transformation on |ay). 

What is crucial, however, is that—as is evidenced from the right side of (5.78)— 
the result of the action of Ü decomposes into factors in IH/ /? and H”. As shown in 
the proof of Theorem 5.28, this required factorization guarantees that a state р & po; 
in the composite system Н//О & HW is then transformed by Ü to a state (U pU 1) & 
po, and taking the partial trace over IH leaves us with the sub-system Н! / in the 


state UpU*. Any measurement or observation of the sub-system IH/ / is thus solely 
determined by UpU* and does not depend on which state the ancilla register HW is 
in. That is why the ancilla register can safely be ignored after the use of the circuit Ü 
for the implementation of U. We say that the ancilla can be discarded. Figure 5.9 
illustrates a generic circuit with ancilla graphically. 

For a circuit with initial ancilla state |@;) and final ancilla state |у) the reverse 
circuit starts with the ancilla state |у) and terminates with the ancilla state |@;). 


Input U Output 
€ He" Ü є "He" 
|, -1) [Фл—1) 
e & 
e e 
| Yo) 1) 
Ancilla U, UL Ancilla 
є HE” c He” 
|(@i)w—1) |(@p)w—1) 
e e 
C9 e 
[(®;)о) [(®у)о) 


Fig. 5.9 Quantum circuit U with ancilla 
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Corollary 5.30 A circuit U that has been implemented with the help of a 
unitary О and initial and final states |@;) and |cy) in the auxiliary register 
satisfies 

О ор) = (U*|V)) 6 |ә), (5.79) 


that is, U* is implemented with the help of Ü*, and the roles оў |®) and |y) 
are interchanged. 


Proof From (5.71) and the unitarity of U shown in Theorem 5.28 it follows that 


Ü (U* |) &|ox)) = (UU*|V)) |у) = |9) & la) 


and thus (5.79). 


Since we have defined circuits as particular instances of quantum operations, it 
follows from Definition 3.26 and Theorem 3.24 that every circuit can be represented 
by a suitable set (K;| j € I} of KRAUS operators on H//0, 

Plain circuits and those with ancillas were defined as reversible devices and thus 
trace-preserving quantum operations. Circuits with measurements are generally not 
reversible and their formal definition is quite elaborate and will not be attempted 
here. Suffice it to say that, loosely speaking, they may be viewed as non-trace- 
preserving quantum operations. 


5.4 On the Process of Quantum Algorithms 


For algorithms and computations as part of them it is necessary that we can suitably 
represent the action of functions of the type f : Sini > Sfin on quantum registers, 
where Sini and Sg, are finite subsets of No. Moreover, we want to implement such 
functions physically with quantum circuits that perform these mappings. This can 
be achieved with a construction that makes use of the binary addition per factor. The 
latter is defined as follows. 


Definition 5.31 With the help of the binary addition given in Definition 5.2 
we define for vectors |a) and |b) of the computational basis in "IH?" the 
factor-wise binary addition ЕН as 


: HO" ане" — He” 
2 : 
|а) |b) — |а) |) := Guida; © bj) 


(5.80) 
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Instead of |a) В |р) we will also write this abbreviatingly as |a Hb), that is, 
we use the notation 


0 
la = 0 la; à bj. (5.81) 
j=m-1 


Moreover, let f : No — No and n,m € N as well as H^ :— H8” and IH? := 
‘H®”. We say that a circuit described by the operator Up implements the 
function f on H^ cH? if 


U,: H^ QH? — H^ @ H? 
Ix) & |у) — |х) @ ly EBS (a) ” 


(5.82) 


Exercise 5.64 Show that U; as defined in (5.82) is unitary. 


For a solution see Solution 5.64. 


The implementation of a function as given in (5.82) is an important ingredient in 
the sequence of steps in a quantum algorithm or computational protocol. Generally, 
these consist of the following stages: 


1. Preparation of the input register 

2. Implementation of classical functions f by means of quantum circuits Uy on a 
suitable quantum register 

3. Transformation of the quantum register by means of suitable quantum gates or 
circuits 

4. Reading (observing) the result in the output register. 


In what follows, we first consider in Sect. 5.4.1 the first and in Sect. 5.4.3 the fourth 
stage, which are quite similar in most algorithms. Some general aspects of the sec- 
ond stage will be treated in Sect. 5.4.2. The special form of f and thus Шу in the third 
stage is more particular to a given algorithm. In Sect. 5.5 we thus consider various 
quantum circuits that are required for the execution of elementary computational 
operations in the factorization algorithm of SHOR (see Sect. 6.5). 


5.4.1 Preparation of Input and Use of Auxiliary Registers 


Quite often the starting point of an algorithm is the state in the input register 
Н//0 :— *H*" that is an equally weighted linear combination of all vectors of the 
computational basis. That is, the algorithm starts with the initial state 
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2—1 
1H) = ji ;X |х)" «19/0. 


This is indeed the case in the SHOR algorithm for factorizing large numbers (see 
Sect. 6.5) as well as in the GROVER search algorithm (see Sect. 2.38). With the help 
of the HADAMARD transformation (see Definition 2.38) such a state |Ҹ) can be 
generated as follows. Because of 


|0) +11) 
и? 


H|0) = 


the application of the n-fold tensor product of Н on |0)" є Н! /? yields 


0) +|1) 
H®"|0)" = H*"( |0) & |0) &---&|0) Q H|0) = ® | 
( jr j=n-1 =i у, 
1 
= zz (10) +[1))®---® (10) [0) 
1 
= —(|0...0)+]0...1) ++ [...1)) 
2 ——— М , 
=|0)" =|1)" =|2"—1)" 
1 2—1 
= 2". (5.83) 
х=0 


which is the desired initial state. 


5.4.2 Implementation of Functions and Quantum 
Parallelism 


From (5.13) we know that the representation of functions of the type f : No — No on 
a quantum register has to be implemented as a unitary transformation Uy. This can 
be achieved with a construction, which makes use of the binary addition per factor 
previously defined, as follows. 


Definition 5.32 With the help of the factor-wise binary addition given in Def- 
inition 5.31 we define the operator 


Use TH oen и 
|а) @|b) +> |a) @ ad) ` 


(5.84) 
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|b)” 


|а)" 


Fig. 5.10 Quantum circuit to implement the operator U; 


2 
[ba i) l&m-1 © by) 
e © 

® ® j 

|b1) [a1 © bı) 

® e " 

|bo) X |а0 Ф bo) 
|а„-1) |аһ-1) 

e & 

e & 

a1) ai) 

e @ 

lao) è |а0) 
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О 


for ће binary addition of two vectors 


|а), |b) € SH®”. As before, the thin lines represent the channels (aka ‘wires’) for single qubits. The 
pairs of thick lines represent channels for several (here т) qubits the states of which are vectors in 
tensor products of qubit spaces (here in H®”) 


2 : 
Since Eo (4j © bj)2! < 2" holds, it follows that |a 


b) is also a vector of 


the computational basis in "H^?" As опе can see in Fig. 5.10, the operator Up can 
simply be implemented with m controlled NOTs A ! (X ). Moreover, it is unitary. 


Lemma 5.33 U, 


defined as in (5.54) is unitary. 


Proof We show that UŽ = 1 first. To prove this, it suffices to show that it holds 
for any basis vector |a) Q |b) € "IH?" @ TH®”. Applying the definition of Ug twice 


yields 
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Uz, (la) & |b)) U; (la) & |a Ь)) = а) 8 la (a b)) 


Ww 
(5.84) (5.84) 
B 2 ы E. 
= |a)? C9 la; 6 (aHb),) = |a) & Q la; (qj 6 bj) 
j=m-1 —— (5.80) жук ЕЕ 


= 


| 


la) ®|Ь). 


Hence, Ug is invertible and thus maps the basis |a) ® |b) in "IH?" @ *H?" onto 
itself. Using the result of Exercise 2.15 then shows that Ug is unitary. 


Next, we show a general construction how to build unitary circuits that imple- 
ment functions of the form f : No — No. Precondition for that is the existence of 
two circuits Ay and Ву, which already implement f in a certain form. The impor- 
tance of the following construction is that it allows to implement a unitary operator 
Uy even when f is not bijective. We will see in Sect. 5.5.4 how Ay and By can be 
built in the case of the SHOR algorithm. 


Theorem 5.34 Let f : No — No and n,m € N as well as H^ :— H” and 
HË :— ЇН?” Moreover, let Ay and By be circuits on H^ @ HË such that there 
exist states |o), |а) € H? and for any vector of the computational basis 
|х) Є НА there is a state |w(x)) € НА such that 


Ar (|x) Sla) = |w(x)) @ If (x)) (5.85) 
By (jw) ® If (x))) = |x) & |0) (5.86) 


holds. Then we define on H^ & HP? c HP 


0; := (14 ®5®) (В, ®1°) (14 ® Ua) (А, @ 17) (19 57^), (5.87) 


where SP? : |bi) & |b3) + |b2) & |b1) is the swap operator on НВ & HP, and 
this бу satisfies 


0, (|x) ® |у) @ |®;)) = |x) ® ly Bf (x)) @ oy) . 


With 0; we can implement Uy with the help of an auxiliary register and the 
states |@;) and |оұ), and one has 
U; :H^G HP — H^ gH” 
|x) & |у) — |x) 8 Bf (x) 


(5.88) 
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Proof From the definition in (5.87) it follows that 


Or (|x) & |y) & |ox)) 
(1^ & SP) (В, & 1^) (1^ ® Ug) (А, &15) (p) 8 ox) & |у)) 
(1^ 2528) (By ®15) (1^ & Ua) (Iw(x)) & |f (x)) & |у)) 


{i I 


(5.85) 

= (17 952) (By 1^) (ly) FG) & ly BF) 
(5.84) 

= (14 @8?*) (|х) 8 la) ly BF (x))) 

(5.86) 


|x) 8 ly BF (x)) 8 lay). (5.89) 


The claim (5.88) about U; then follows from (5.89) and the Definition 5.29. 


The swap operator SP? used here acts on |a) & |b) € HË @ H? by exchanging the 
factors and can be implemented with the help of m simple swaps as represented in 
Fig. 5.5. The circuit to implement Uy is shown in Fig. 5.11. 

We define Uy for vectors |) on the whole of H^ & Нё by linear continuation 


2n. .]2m. | 


ОФ) :— 2 li 9.) ® |y Bf (x)). 


If we apply U; to |"%) :— (H"|0)") & |0)” € H^ & НЗ, we obtain 


|x) |w(x)) |x) |x) 
Af В; 
® | [77 lf (x)) lf (x) |r) & 
U; 
ly) ly B f(x) ly B f(x) 
0; 


Fig. 5.11 Circuit for implementation of the operator Ur 
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1 2"—1 
О |) = uj((H"0)")&J0)"). = — У, Ur(p)" e0)") 
ae х=0 

21-1 
oo À |х)®|/(х)). (5.90) 


cH4A@HF 


As we see in (5.90), applying U; once to |P) results in a state, which is given by a 
linear combination of all 2" states of the form |x) & |f (x)) for x € {0,...,2" — 1}. 
Intuitively, this can be seen as amounting to a simultaneous evaluation of the func- 
tion f on its total domain (0,...,2" — 1} in one step, and is thus called massive 
quantum parallelism. This interpretation seems to originate from the fact that the 
appearance of all terms of the form |x) & |f (x)) in Uy | V5) is similar to a complete 
evaluation-table (x,f (х))х—о,...2"—1 of the function f. In general the production of 
such a table would require 2" evaluations of the function f. This would require 
O(2") computational steps, whereas the evaluation of all |x) & [f (x)) in (5.90) only 
requires one application of Ur. However, even though one application of Up yields 
a superposition of all possible |x) & |f (x)) at once, it is not possible to read the 
values f (x) for each x separately from the state U; |). In order to access infor- 
mation encoded in the linear combination of all |x) ® |f (x)) in Up |V6), we need to 
apply further transformations that exploit particular properties of the function f. For 
example, in the case of the SHOR algorithm (see Sect. 6.5) one applies the quantum 
FOURIER transform (see Sect. 5.5.5) to Up |) and makes use of the periodicity of 
the function f. 


5.4.3 Reading the Output Register 


According to Definition 2.28 of qubits, there exists an observable o; the measure- 
ment of which yields one of the values in {-Е1} and according to Corollary 2.29 
projects the qubit onto the corresponding eigenstate |0) or |1). In a composite sys- 
tem comprised of n qubits, which is described by states in "H^", such measurements 
can be performed on each qubit, that is, for observables operating on each factor 
space "Н; in “Н”, where j € (0,...,n — 1}. Each such measurement of o; on a fac- 


tor space corresponds to a measurement of the observable xi = 89717 @ с, 18i 
on the composite quantum system "IH?", Since xi only acts non-trivially on the fac- 
tor space Hj, one has sxe = 2 zÍ for all j and k. The xi are thus compatible and 
can all be measured sharply. 


Definition 5.35 Let n € N and for j € (0,...,n — 1} and a € {0,...,3} (or, 
equivalently, о € (0,x,y,z]) define 
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p d cO ol ene 


where the Og are as in Definition 2.21. The observation of a state in the 
quantum register "IH?" is defined as the measurement of all compatible 
observables | | 

Б <= co de 


for j € (0,...,n — 1} in the state of the quantum register. Such an observation 
is also called read-out or measurement of the register. 


The read-out of the register "IH?" yields n observed values (Sn- doses 50) € (x1 
after measuring 2, zi ‚20 . We identify these observed values with classical bit 
values x; as shown in Table2.1, and use these classical bit values (Xn—1,---,X0) 


for the binary representation x — So х2 of a non-negative integer x « 2". The 


measurement of the observables XJ projects the state in factor space “H; onto the 
eigenstate |0) or |1) corresponding to the observed value s;. Altogether the read-out 
of the register "H^" thus reveals a non-negative integer x < 2” and leaves the register 
in the computational basis state |х). 


5.5 Circuits for Elementary Arithmetic Operations 


In the following section we first consider a quantum circuit that implements the 
addition of two non-negative integers [72]. Building on that we look at further cir- 
cuits that implement additional elementary arithmetic operations. These will finally 
allow us to present a quantum circuit that implements the modular exponentiation 
xe b* mod N, which is required for the SHOR factorization algorithm. 


5.5.1 Quantum Adder 


In the following we show how, with the help of elementary quantum gates, one 
can build a circuit that implements the addition of two numbers a,b € No [72]. In 
doing so, we make use of the results about elementary algorithms for addition and 
subtraction in binary form presented in Appendix B. 

We begin with the implementation of the sum bit s; from Corollary B.2 by a gate 
U,. For this we define the following operators on "Н. 


19-(x-1)e|)ü|e 1 
1+ (X-1)@ 1 ®[1)(1| (5.91) 
BA 


А: 
В: 
Us: 
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Fig. 5.12 Gate U, for 2 2 2 
binary sum used in addition о) X lxi ф хә) X [xo Ф х: Ф хә) 

& e 

|х) | lxi) lxi) 

e e 

|хо) A |хо) 

А В 
Us 


Because of |1)(1|* = |1)(1| = (DNŽ, Х* = X, X? = 1 and thus 2(X — 1) + 
(X — 1)? = 0, it follows that A and B are self-adjoint and unitary. As can be seen 
from (5.91), one also has AB = BA. Then it follows that U; is also unitary since 


U* = (BA)* = А*В* = AB = ВА = U; 


$ 


а$ ууеП а$ 


(U,)* = АВАВ = BAAB = B? = 1. 


On vectors of the computational basis |x)? = |хә) & |x1) & |x) in "IH? the operators 
A,B and U; act as follows: 


2 
A (Ix) |а) & xo) ) = b x2) ә а) ә ho) 


B(Ixz) ®@[х)® к) = [xo Ф x2) & |x1) ® |xo) 
(5.92) 


2 
Us (b2) ®|x1) @ о) =В(|х © x2) |а) € к) 
2 2 
= [xo Ф х Ф хә) 69 р) 69 |хо). 


In Fig. 5.12 we show U; graphically as a gate. 
From Corollary B.2 we know that the sum of two numbers a,b € No with a,b < 
2" and the binary representations 


п—1 . 51-1 . 
a=% a3, b=} b 
j=0 j=0 


is given by 
n—1 
а+Ь= У 5% +042", (5.93) 
j=0 
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where aj,b; € (0,1) and cj :— 0 as well as 


ct :— aj 4b; à METAI Sb; n for j 1 5.94 
j = ajabja Өау-1су_| Ө Ву лусу | orj € (1,...,n] (5.94) 


2. o2 
Sj := aj 6 bj Oc? forj € (0,...,n— 1} (5.95) 
holds. From (5.92) and (5.95) we thus obtain 
U (Ib) la) lc) = ls) ela) ®|с]). (5.96) 


By repeated application of О; we can then generate the qubits |s;) of the sum bits 
defined in (5.95) and needed in (5.93) if we have the qubits Ic?) of the carry terms 


c} available. In order to calculate these, we build a gate U, with the help of the 


following four operators on ‘H®*: 


+ (X-1)@ |101 ®[1)(1[® 1 
:= 18+ 1 ®(Х-1)®[1)1]® 1 
= 1%+ (X-1)@ DUL ә 1 ®[1)(1| 


турс 
VY 


For the action on a vector |x)^ = |x3) & |x2) & |x1) & |xo) of the computational basis 
of HS4 we obtain for these operators 


2 
C(Ix3) & е) аа) ә) = [x22 © хз) ®|х) 8 а) ә |ә) 
D(Ixs) |) ёра) а |а) = аз) |а Фх) @|x1) @ [xo) 
Е(|з)® е) ә |а) кея buxo & хз) @ |хә) аи) ® [xo) (5.97) 


U, (1x3) & |x2) ® |x1) ® |) „у 


= к $35) @ | È x2) ® |) @ lxo) ) 
: 


2 


2 
[xo(xi Ө x2) © xix x3) ® [x1 622) ә |а) ә). 


From (5.97) and (5.94) one finds then 
о.(10) 15-1) ® laj-1) ® lef) 
+ A + 
= lc; ) @ |bj-1 © aj-1) 8 |aj-1) 8 |1). (5.98) 


Hence, we can generate the qubit Ic?) of the carry term с] by suitably repeated 
application of Uc. The gate U, is represented graphically in Fig. 5.13 
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x3) X [xix Фаз) X xo(xi Sx) xix Ф) 
® e 
2 2 
x2) |x2) " [xi © x2) d xi 9 x5) 
® ® 
x1) x) | |х) xi) 
® ® 
xo) xo) 
C D E 
U. 


Fig. 5.13 Gate U; for carry in addition 


For the same reasons as for A and B (see discussion after (5.91)) it also follows 
that C, D and E are all self-adjoint and unitary. However, even though U; as a prod- 
uct of unitary operators is also unitary, it is no longer self-adjoint since one has 


Už = (ЕРС)* = C*D*E* = CDE 4 EDC. 


For Už we find, instead of (5.97), for the action on a vector of the computational 
basis of SH®* 


2 
U (pa) ®|ю)® ра) ®|)) = CD (1x02 $ x3) & a) © а) o) 


2 2 
= C(lxox2 © x3) 8 [x1 © x2) еа) e |) (5.99) 
2 2 2 2 
|x (xı 8 x2) 4 В хз) & [x1 Ө x2) & |xi) 8 |х) 
2 2 
[(xo © x1)x2 4 


хохо 
2 2 
Э x3) & [x1 Ө x2) 8 |x1) & [xo) .- 


x 


Exercise 5.65 Show that UŽU, = 1. 


For a solution see Solution 5.65. 


By suitably combining U,;,U, and Už we will build a quantum circuit that imple- 
ments the addition of two numbers a,b € No. In order to formalize the statement 
about such a quantum adder we still need a few more definitions. 
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Definition 5.36 Let n € N and 
HE з= IA HÉ g= a H c= н“ 


For vectors of the computational basis |b) ® |a) ® |w) € HË 9 H^ ОНУ we 
define Up and |¥[b,a,w]) € HË & H4 @H by 


0 


U (|b) ®|а)®|)) := b) & Q (Ib) ® lar) әм) 


1=п—1 
=: [V[b,a,w]) (5.100) 


and on all of HË & H4 & HV by means of linear continuation. 
Furthermore, we define on HË @ H^ & HH the operators 


п—1 


Фу з= П 90,9 ip 
i-i 


U2: 


[85 (тәл (X) @1)U.] e 1590-5 


І 
U:- [I (182 ә (19 0;)U? 1830-1) 
1=п—1 


Up U3U2U Up. 


A 


U, : 


Note that HË has one qubit more than H^ and HW.. This additional qubit is always 
zero for b < 2". It is necessary, however, for the addition b+ a in which it will be 
set equal to the highest carry qubit |с). We refer the reader to Appendix B for the 
definitions and roles of the carry and sum bits c? and s; in the addition b + a. 

In the formal Definition 5.36 alone, the construction of the operators Uo, ... , Us 
is rather obscure. They are easier to understand if we display their constructions and 
their roles in the addition graphically. Figure 5.14 shows such a graphical represen- 
tation of the operators Up,...,U3,U,,U as well as |ҸТЬ, а, 0)). 


Lemma 5.37 The operators Uo, ... ,Us and О, defined in Definition 5.36 are 
unitary. 


Proof As can be seen in (5.100), the operator Up maps each vector of the computa- 
tional basis bijectively to a vector of the computational basis. According to the first 
statement in Exercise 2.15, it is thus unitary. 
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From Exercise 5.65 we know that (7. is unitary and since for each Г € (1,...,n— 


1} 


( &U'& joe ue $U,G germ —18 e U*U.G 1830-170 


= 18” 


then (7 as a product of unitary operators is itself unitary. The proof that U3 is unitary 
is similar. 
For U5 we have 


Uj = [i 845,0 өп) 1e и; ) @ 123-1) 


=U, 
=A 1%) 1 


and thus 


Uit; = Ute Ay (08 1) (184) (16Aj 008 1)0,| e 1950-0 
—1®4 


= UE (18 Agi (X) 81) U, 9 199070 


= 1837+! 


Finally, Ü. being a product of unitary operators is again unitary. 


Theorem 5.38 There exists a circuit U, on H!/° = HP @ H^, which can be 
implemented with the help of the auxiliary register HY by Û,, that is, there 
exists a Ü} € щ(н!/° QH”) such that for arbitrary |Ф) € H!/° one has 


0, (1Ф) &J0)") = (И |Ф)) ә |o)" . (5.101) 
Furthermore, for a,b € No with a,b « 2" we have that 
0300 | |b, a,0]) = |F [b 4- a,a,0]) (5.102) 


and thus 
U (|b) & |a)) = |b - a) & |а). (5.103) 


Proof First we show (5.102). The proof of this claim by means of the operator defi- 
nitions and a sequence of equations is laborious and not very instructive. Much more 
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2, 2, | 
0) афу © сүа, 6 cj bi) = |5) U. | 
с 


bi) bi e а) 
U. 
а) а) 
0) aobo) = |сү) ct) 
bo) bo Ф ag) 
U: 
ao) ao) 
0) 0) = |с) 


Fig. 5.15 Sub-circuit U; of the quantum adder 


2 + 2 " 2 $ 2 + 2 

lbn) |a@n—1Dn—1 Өс}_үа„һ-1 Ф си ури Ө bn) = |с} @ dn) |с} @ bn) 
2 2 2 
lbn-1) ра San-1) [ y | loni) [bn—1 8 Gn—1 ® cf) = |Sn—1) 18-1) 
Ue 
14-1) 14-1) 14-1) y, an1) |@n—1) 
б | |o |a) t) | |o 0) 
0, - 


Fig. 5.16 Sub-circuit U2 of the quantum adder 


illuminating and just as valid is a proof with the help of the graphical representations 
of the individual operators or parts thereof. 

From (5.98) and Fig. 5.15 we see that the sequence of the U, in Uj delivers the 
carry qubits Ic") (see Corollary B.2) of the addition of a and b in the uppermost 


fourth channel, starting with |су) and then successively up to |с} |). The third chan- 


2 
nels of U, in U, always deliver Ibi © i54) while in the first and second channels 
the input passes through unaltered. 
Similarly, one sees from (5.96), (5.98) and Fig. 5.16, that U2 delivers in the fourth 


2 
channel |b, © c; ) and in the third the sum-qubit |s„—1) of the addition of b+ a (see 
Corollary B.2). Hence, in the case b < 2" the most significant carry qubit |с) of the 
addition b+ a is delivered in the topmost channel of U2. 
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y, Lie 0) 0) 

2 m 

bi aj) bi) la, Bb; 6 c1) = |81) 51) 

U; 

a) а) ТА |а) а) 

eq) er) [20 0) 0) 
2 

bo Ф ао) bo) so) 

Už 
ao) ao) U, ao) 
0) 0) 0) 


Fig. 5.17 Sub-circuit U3 of the quantum adder 


Finally, one obtains from (5.99) and Fig. 5.17, that U3 reverts the channels with 
the carry qubits |с ,),...,|су) to |0) and delivers in the third channels the sum 
qubits |5,_1),..., |50). Furthermore, U3 delivers the |a; .1),..., |ao) unchanged. 


Altogether thus 


0 
| [b,a,0]) = |0) & &) (Ib) & la) &0)) (5.104) 
1=п—1 


is transformed by U3U2U into 


0 
03020 |Ҹ[Ь,а,0]) = |с) ә) (Is) ® lar) &|0)) = |'PIb--a,a,0]). (5.105) 
1=п—1 


This completes the proof of (5.102). 
In order to prove (5.101), we note that, because of 


2ntl..12n..] 


|Ф)= 2, У, Pra\b) & |а), 


а=0 


it suffices to prove the claim for an arbitrary vector |b) & |a) of the computational 
basis of IH? Q НА. For these we have 
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б (|b) & |a) & |0)") = Ug U3U2U, Uo (|b) & |а) & |0)") 


0 
= обол (bn) ® Q (6) & lar 8 10))) 
1=п—1 


= UğU3U2U1|Y[b,a,0]}. (5.106) 


The only difference between the argument of Uj U3U2U in (5.106) and the right side 
of (5.104) is that b, in (5.106) can be different from zero. But this changes only the 
output of the most significant qubit in HË. From (5.97) and Fig. 5.16 we see that U2 


2 
for this most significant qubit delivers |b, © сї), which is the sum qubit |s,) since 
an = 0 holds. All other qubits are transformed by U3U5U, exactly as in (5.105). 


However, the qubit in the carry state |с} 11) from b +a will be lost. Hence, the 
+ 


number b +a — сп Qu is generated in HË. Consequently, for a and b such that 
0 <а < 2" and 0 € b< 2"*! we have 


0. (|b) & |a) & |0)") = 0003001 |Y [b,a,0]) 
= Uj|V [b насі ,2"*.,a,0]) 
= |b--a— c} 12") & |а) & |0)" 
= U.(|b) @|a)) 8 |0)”. 


This proves (5.101). For a,b « 2" one has CUT — 0, and thus (5.103) follows as 
well. 


From Theorem 5.28 it follows that U is unitary and thus invertible. Indeed, the 
inverse of U is a circuit, which implements the algorithm of the binary subtraction 
b — a formalized in Corollary B.5. 


Corollary 5.39 There exists a circuit U_ on H!/° = HP & W^, which is 
implemented with the help of the auxiliary register HY by Üt E Шс that 
is, for arbitrary |Ф) € Н!/О one has 

0; (|Ф) = |0)”) = (U_|®)) ә |0)”, (5.107) 


where also U.. = Uy = Ut holds. Furthermore, for a,b € No with a,b « 2" 
we have that 


UtU$US V [b,a,0]) = |P |c; 2"*! 4-5 — a,a,0]) (5.108) 
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and thus 


|b—a)G|a) if b>a 
!-b—a)e]|a) if b<a ` 
(5.109) 


U. (|b) & la)) =|c,2"*!4b-a)@|a)= | 


Proof From Corollary 5.30 we know that for arbitrary |Ф) є IH//? 
0: (|®) & 10") = (u:19)) ә 10)" 


holds. With U_ = U% this implies (5.107). 

The proof of (5.108) is similar to the proof of Theorem 5.38 in that we consider 
the respective actions of U;,U; and От. From (5.92) as well as Fig. 5.18 we see 
that the U, leave the first two input channels unaltered. In the third output channel 
the U, deliver the qubit |d;) of the difference bit of the subtraction b — a as defined 
in (B.12). Thereafter, the U, act in that they also deliver the first two inputs lc; ) and 


aj) unaltered, but in the third channel they deliver |b; © c; ) (see (5.97)). Moreover, 
we see from Fig. 5.18 as well as (5.97) that the U, deliver in the fourth channel the 
qubits lc; ) of the carry term of the subtraction b — a defined in Corollary B.5. This 
is because 


2 2 
cj_(aj-1 dj-1) 6 aj-idj-1 
Е 2 2 2 2 2 Dern 
= ‚су 1(aj-1 aj-1G bj1 cj ү) 6 aj-1(Gj-1 © Hj-1 c; 1) 
(B.12) 


2 2 2 2 
c; 4bj-1€ c; Фаз © aj-1bj-1 © aj-16; | 


vA 2 
|0) [сү (a1 © di) @ aids) = |с; 
kea 2 2 2 2 
р) ley Фа ® bı) = |4) |а Фа) = |c] Oy 
U: 
lai) u, Ha jai) 
2 E E Е 
10) ao © aobo) = |су) ler) lei) 
lbo) [ao & bo) = |do) Jao ® do) = |bo) 
U: 
ао) Јао) ао) 
Us 
0) 10) = |с) lea) 


Fig. 5.48 Sub-circuit U% of the quantum subtractor 
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2 
=|с„ © by) 
2 2 2 2 
bn) |(с„_,Фа„—1)(Ьһ-1 Фс)  An—1 € bn) 
б 2 re 
|bn-1) |dn—1) |Dn=1 © 4) [р„-1 © an-1 Ф с. 4) = |dn—1) 
X 
и; 
|an—1) |an—1) |an—1) |an—1) |an—1) 
0, 
|0) lea) lea) |1) |0) |0) 
Ue Už 
Fig. 5.19 Sub-circuit Už of the quantum subtractor 
2 X  . 2 Е 
= (16bj1)(aj-19 c.) ©а-асу | 
= С 
М d 
(В.11) 


holds. 


From (5.99) and Fig. 5.19 one sees that Už delivers in the first channel the qubit 
|с) of the carry, in the second channel |а„— 1), in the third the qubit in the state 


|4,1) corresponding to the difference term and in the fourth |b, H c, ). In the case 
b < 2" one has b, = 0, and in this case U; delivers in its topmost channel the most 
significant qubit |с, ) of the carry of the subtraction b — a. 

The fact that, as shown in Fig. 5.20, every |c,_,),..-,|¢g ) is transformed by От 
to |0} can be seen as follows: 


2 2 2 2 


bj-1 6 aj-10; у ® aj-1bj-i Фа B aj-1 


= C j 


j-1 


lj- 


2 2 2 _ 2 Е 
@ cj , © aj-1bj-1 Фс убу 1 aj-16; , 
= 0 


Finally, the Už in UT invert the action of the U, in Už also in the third channels and 


thus deliver 


there |dj). 
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и; 19) (cy 5 а)(ст Ф bi) Фа 6 e) =|0) 0) 
_2 "NP E 
сү Bhi) ai bı ci) = |di) di) 

us 
ai) a1) a) 
сү) сү) 0) 0) 
bo) ao Ф Бо) = |40) do) 
Us 

do) do) ao) 
0) 0) 0) 


Fig. 5.20 Sub-circuit Us of the quantum subtractor 


Altogether, one has thus for a,b < 2” 


0 
U;USUS(\bn) & Q (Ib) ® lar) 810))) 
(5.100) I-n-l 
0 


= |с„)® Q (14) 9 la) &0)) 


1=п—1 


Uj U;U3|'P[b,a,0)) 


п—1 
c, 2" + у,а2!,а,0 
1-0 


mu ). (5.110) 


(5.100) 


On the other hand, we know from Corollary B.5 that 


п—1 


У dj! =с 2"+Ь—а (5.111) 
j=0 
holds, where 
= 0 if b>a 
Cn SE if b<a. (5.112) 


Hence, (5.108) follows from (5.110) and (5.111). From (5.108) and (5.112), in turn, 
follows (5.109). 
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5.5.2 Quantum Adder Modulo N 


With the help of the quantum adder U, and subtractor U_ we can now build a 
quantum adder modulo N € N, which we denote by фу. In general one has (b+ 
a) mod N € {0,...,N — 1}. On the other hand, it is not necessarily the case that 
N = 2", such that the image under mod № does not coincide with a total space 
HS”, Since Uyyy ought to be unitary, we need to suitably restrict the HILBERT 
space on which the operator (7 у acts. 


Definition 5.40 For N € N with N < 2" we define HI*" as the linear subspace 
of "IH?" spanned by the basis vectors |0)”,...,|N — 1)" 
H<” :— Span{|0)”,..., |N — 1)”} 


N-1 
= {|Ф) eu? le) = Y, Фа) i 


It is laborious and not very instructive to define the operator (7 фу with the help 
of formulas. Instead, we use the simpler and clearer graphical representation shown 
in Fig. 5.21 as definition. 


Definition 5.41 The quantum adder modulo N is the operator (фу on 
H!/° = H @H<" representing the circuit shown in Fig. 5.21, which is 
implemented with the help of the state |@;) = |N)” & |0)! = [оу) in an auxil- 
iary register HY = se". 


Theorem 5.42 Let n and № be natural numbers satisfying N < 2". The oper- 
ator U øy shown in Fig. 5.21 satisfies 


Uon : H< QHN — HN @H< 


Ibela) = |(6--а) тойм) ја)" с 
Furthermore, Usqy is unitary and we have 
DLE o «М <N <N <N 
U_gn := Uf gy : Н @ HS" — Hs" @H (5.114) 


|р) |а) ++ |(b—a) modN)G|a)' 
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Proof Since N < 2" is assumed, IH" is a subspace of "IH?" and 79%"! and can be 
embedded in these. In Fig. 5.21 we thus consider the arguments |р) @ |а) € H//? = 
HN о Н“ as vectors in "Н"! @ HE” on which, according to Definition 5.36, 
Theorem 5.38 and Corollary 5.39 the adder U, and the subtractor UL = =U}! are 
defined. The auxiliary register HW = 1H®”+! is pre-set with |N)" @ |0)!. One has 


1 
Uan = а, 
1=9 
and for the proof we consider successively the results of the transformations A,...,A9 


defined in Fig. 5.21. 

To begin with, U+ in Aj is applied to |b) ® |a), which, according to Theorem 5.38, 
yields |b+ a) & |a). 

Application of the swap operator S in the second step swaps |N) in the auxiliary 
register with |а) such that afterwards |a) has been deposited in the auxiliary register. 

In Аз then U_ is applied to |b +a) & |N), which, in accordance with Corol- 
lary 5.39, yields |c- 2^*! + b-- a — №) & |N). Here we have indexed the carry bit 
c2- with the superscript 3— in order to distinguish it from the carry bit of a later 
subtraction. From Corollary 5.39 we also know that 


anc. 0&b+a>N 
са { lobta<Nn 

holds. The value of e will then serve in the subsequent transformations A4, . . . ,Aọ 
within үф as a distinguishing indicator for the cases b+a > N orb+a<N. 

In A, the state |с) of the carry qubit is written by means of a controlled NOT 
Aly! (X) in the target-qubit, which was initially in the state |0)! in the auxiliary 
register. 

In the fifth step in As the target-qubit in the state |c3~) FORES the application of 
the addition U, on |c2- 2"*! 4- b-- a — №) & |N). In the case c?- = 0 no addition is 
performed. In this case the ка of the fifth step is |-2- 2^*! +b+a—N)@|N) = 
|b-- a — N) & |N). In the case c37 = 1 the addition will be performed. This addition 
is the inverse of the previous subtraction in step three. Thus, the state prior to that 
subtraction is recovered. The result of As is in this case |b 4- a) & |N}. Altogether the 
result of As can thus be written as |b +a + (c?- — 1)N) & |N). 

In Ag the swap of the second step is inverted by a further application of the swap 
operator S. After that |a) is again the state in the second factor space of Н! /0 = 
HN QHN c H+ @ IH", and |У) becomes the state in the auxiliary register. 

But the target-qubit in the auxiliary register is still entangled with the state in 
HE+! @ 1HE”, In order to disentangle these states (see remarks before and after 
Definition 5.29), we subtract a with U_ in a seventh step from b +a + (с — 1)N. 
If с? = 0, the result of this subtraction is b — N < 0, and thus the state oF the carry 
qubit becomes |c/~) = |1). If, on the other hand, |c7- ) = |1), then the subtraction 
results in b > 0, and the state of the carry qubit becomes |c7- ) = |0). 
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The value of the carry bit c77 then controls in Ag the re-setting of the target- 
qubit in the auxiliary register to |0). Finally, in Ao the subtraction of A; is inverted. 
Because of a,b < N, the final result in the first factor space H<" of IH//? is thus 


= b-c-a—N) if b+a>N 
b 4- a 4- (c? -0ю= {1 с iE biacN =|(b+a) modN). 
(5.115) 


* 
For U 4м One has 


9 
* * 
Ula = | [4; $ 
1=1 


Here it should be noted that іп Ат, А5 and Ад then Už = U_ holds and in Аз and A7 
conversely U* = U, holds. With exactly the same arguments as in the derivation 
of (5.115) one obtains that for a, b < N 


Ura (181) = 2090 мра (6-а) modN)eja). 


With this and (5.115) it follows that for a,b < N 


Uy en U+cN (|b) ® [а)) = Utaw(lb-a) mod N) ә|а)) 
\|((b+a) modN— а, ) тойм) |а) 
=a modN 
= |b modN)®|a) 
м 
(D.23) 
= |b)8]a) 


holds. Consequently, Uy is unitary. 


5.5.3 Quantum Multiplier Modulo N 


With the help of the quantum adder we now define the multiplication modulo N 
with a number c € №. 


Definition 5.43 For c € No and n, N € N we define Uxcøn as the quantum 
multiplier modulo N on H//? = H< c*IH*" as the operator representing the 
circuit shown in Fig. 5.22, which is implemented with the help of the states 
|@;) and |@,) in an auxiliary register (НУ ges 
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As one can see in Fig. 5.22, the operator (7, сфу is implemented with the help of 


an auxiliary register HW = (H*N | ш In this auxiliary register the initial state is 
set to 
|90) = |0) &|c2"7! mod N)@---@|c2° mod N). 


To prepare the initial state, one calculates c2"^! mod N,...,c2° mod N with the 
help of a classical computer and prepares |@;) in the auxiliary register accordingly. 
The final state in the auxiliary register is given by 


loy) =|0) &|c2"? mod N) @-+-@|c2° mod N) 9 |с2"-! mod N) 


and differs from the initial state |o), but is always the same, independent of |b) & 
la). This means that states in the auxiliary register remain separable from those 
in the input/output register (see discussion around Definition 5.29). One could, of 
course, transform |y) via suitable swap operations to |@;), but to keep things as 
simple as possible, we have refrained from doing this here. 


Theorem 5.44 For any operator О, сфу defined as in Definition 5.43 we have 
Осем (|b) &|a)) = |(b+ca) mod N) & |a) (5.116) 


as well as 
Ux æn (|b) &|a)) = |(b—ca) mod N) ®|a), (5.117) 


and Uxc%N : 1/0 _, HEO is unitary. 


Proof As we see in Fig. 5.22, the operator О, сфу consists of repeated additions 
U,«y controlled by |ак) with k € (0,...,n — 1}, where, before each of these con- 
trolled additions, the state |c2* mod N) is swapped from the prepared auxiliary reg- 
ister to the entry register for the second summand. In the first step one has, because 
of b < N, after the addition controlled by |ao) in H!/° the state 


(О.у) (|b) & \c2° mod N)) 
(Ом) (Ib mod N)®|c2° mod N)) 
|(Ъ mod N + аос20 mod N) mod №) @ |c2° mod N) 


: {i [ 


=, |(b+aoc2°) modN)®|c2° mod N). (5.118) 
(D.23) 
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After that, |c2! mod N) is swapped into the input for the second summand, and the 
addition controlled by |a) is executed. In the kth step one has, analogously, 


k-1 
(Uso (106+ У, 42) mod №) ® |c2* mod N)) 
j-0 


k-1 
=|((b+¢ у a2) mod N + a,c2* mod N) mod №) @|c2* mod N) 
j=0 


k 
= |(b+c > а2/) mod №) @|c2* mod N). 
j=0 


After the last addition, the first channel of the adder controlled by |an—1) thus deliv- 


ers the state 
n—1 


(b+c aj2/) mod N) = |(b--ca) тойм) 
j=0 


in its output. In the second channel the state |c2"^! mod №) is delivered, which 
is swapped with |0). This last swap is not really necessary since even without it 
the auxiliary register is separable from the input/output register. This completes the 
proof of (5.116). 

For the proof of (5.117) one notes that Už „у corresponds to a reverse run 
through the circuit shown in Fig. 5.22 from right to left. This amounts to a circuit in 
which the steps of О, сфу are traversed in reverse order and where the initial state in 
the auxiliary register is now |@,), and the final state is |@;) as well as where U , с 
has to be replaced by U? „у = U_%n. Analogous to (5.118), the first step is then 
a subtraction of c2"! mod N controlled by |a; 1). These controlled subtractions 
are continued until the last subtraction of c2? mod N controlled by |ao). Altogether, 
the input |b) ® |a) is transformed by Už „у into (b— ca) mod N} & |a) as claimed 
in (5.117). 

We thus have 


UrcanUxesn (ID) @la)) = Us.qy(|(b-+ca) mod N)® la) 
= |((b+ca) modN ca) mod N)G |a) 
f ((b+ca) modN —ca mod N) mod N)6G |а) 
(D.23) 
= |b тойм) ® |a) 
м 
(0.23) 
= pelo) 


proving unitarity of (7, сфу on H!/° = HN @ H2”. 
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Its name as a multiplier deserves (7, су because 
Осем ([0) &|a)) = |ca mod N) & |a) 


holds. With the help of the construction in Theorem 5.34, the function a +> ca 
mod N can then be implemented. 


5.5.4 Quantum Circuit for Exponentiation Modulo N 


At long last we are now in a position to present a way to implement the function 
fo, N(x) = b* mod № by means of a quantum circuit. 


Definition 5.45 For b,n,N € N we define Aj, оп Н?" & H*" as the cir- 


cuit shown in Fig. 5.23 with the state |@;) = (em 0)) & |1) = |o) in the 


auxiliary register Н” = (H<) K 


The implementation of Ау, , is essentially a version of the fast or so-called binary 
exponentiation with quantum circuits for a given b. In this construction the num- 
bers Bo :— b" mod М,....В-1:= b" modN are pre-calculated with a classical 
computer and then the quantum multipliers U% Вам are prepared. 

In Definition 5.45 we have Аб, restricted in the second argument to H<”, but 
for N < 2" we can view H<% as a subspace of 1". We use this in Theorem 5.46. 


Theorem 5.46 Let b,n, N,m € N with N < 2" and fy (x) :— b* тойм. 
Then for any x € No with x « 2" 


Ag, (|x) & |0)”) = |x)" & fo. Q2)" (5.119) 


holds as well as 


Af, (00^ 8 ffo )") = |x)" e |0)”. (5.120) 


Proof In Fig. 5.23 we use the abbreviating notation Bj = b” той №. We see there 
that the first part of Aj, „ consists of successive applications of U, Bi %N and then 
U+æn. Each of these multiplications is controlled by a |). For these one has, in 
general, for s € (0,1), c € No and |a) € H* that 
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Fig. 5.23 Quantum circuit Aj, „ to implement the function fp y (x) =" mod №; here we use the 


abbreviating notation Bj — b” modN 


5.5 Circuits for Elementary Arithmetic Operations 235 


1-5 s U% 0) 9 [а)) if s=0 
(Cian) (Uan) (еа) =, {Cee (Elen) rn 
(5.116) 

"m а mod N) |а) if s=0 


Vv S mod №) & |a) if == 1 
Gi» 


= |c’a тойм№) |a). (5.121) 


Beginning with the first two factors of the auxiliary register, one has then 


(Uzan) (Ug) " (10) ® |1)) Ser 80° mod N) &|1) 
(5.121) 


(o? modN)" mod N) @|1) 
L? mod N) @|1). 


= 
У 
N 
N 

— 


In the kth step this becomes 


(Uran) ida (Uxp,%n) * (0) & ГА) 5? mod N)) 


Кей] keles 
= I(B (B=? mod N)) mod N) @ |6202 той N) 


_— 
(5.121) 
= (С mod №)? (p EL mod N)) mod N) @ [223 j=0 2) mod N) 
T k-1 2j 
ГЕИ mod №) & |6202 тоа №). 


After the application of (0; у) i [sn wv)" опе then has in the second 
input/-output channel as desired 


Ip; cox? mod №) = |b" mod N). 


This remains unchanged by subsequent applications of the 


* 2 * 1—x * X. —X, 
(UXgaw)"( ton) i -( x Be GN * (U aw). k 


fork € {n—2,...,0}. These conditional operators disentangle the auxiliary register 
from the input/output register as can be seen as follows. First, we have, in analogy 
to (5.121), for s € (0,1), c € No and |u), |у) € H< that 


" 5 1-5 |. fl(u—v) modN) ә |у) if s=0 
FUP SUM сы Uy еам (10) 8|v)) if s=1 
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Е |(u—v) mod N) ® |у) if == 0 
ме | |(и= су) mod N)&|v) if s=1 
(5.117) 

= (ису) modN)@|v). (5.122 


In the second part of Aș, , one obtains thus with the kth step 


(Ug) (Us) 9 (9992 mod) ap moam) 


= | (phe mod N — (p? mod №)" (2 =" mod N)) mod N) 


(5.122) 
ae 
&jb5- S" mod N) 
=, |0) |62509 modN). (5.123) 
(D.21)—(D.23) 


In particular, for k = 0 we have 


(Ux вом) (U-aw) "(| mod N) ә |1)) 


= | (p? mod N — (p? mod N)"*) mod N) ® |1) 
(5.122) 


|0) & 1). 


This proves (5.119). 


In order to show (5.120), consider that A7 


у emerges from the circuit of Aj, y by 


the replacements 


U+ønUxp æn — UrgayU-«v for КЄ (0,...,n— 1] 
Ux. 8. %NU-%N — Us%nU xB, %nN for КЄ {n—2,...,0}. 


Due to the symmetry of the circuit, this means that the circuit of Ary only dif- 
fers from the one for Ау, in that in place of (U,«w) L72-1 (Uxp ion] then 


(Ula mu) (U-aw) "med appears. This implies that 
Xn- 2» n—2 әј 
(Uis, uw) (Осам) "7 (I mod N) е 027592 mod N)) 


Хр _ п—1 5j n—2 ој 
= (Uta, йу) ОЕ, 9-1 (IpEi-o x? mod №) & [627-0 02 mod N)) 


= |0) ® [622-0202 mod N) 
(5.123) 


holds and (5.120) follows. 
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With the help of the construction in Theorem 5.34 we can then implement the 
function x — b* mod N. 


Corollary 5.47 Let b,n,N,m € N with N < 2" and НА = *H*" as well as 
H? = *H*" and f, у(х) =b* mod N. With the help of the states |co)) = |0)” = 
|y) in the auxiliary register H? we can implement Uy, , for which 


U; : H @H? — H^ g9 H? 
Ix) |y) — |x) @ |y Efn (x)) 


holds. In particular, one has 


Ups. (b) ® [0)) = |x) әм (к). 


Proof The claim follows from Theorem 5.34 by setting there Ay = Ay, „ and By = 
A x from Theorem 5.46. 


The statement in Corollary 5.47 is essential for the SHOR factorization algorithm 
in Sect. 6.5. This also applies to the quantum FOURIER transform, which is covered 
in the following section. 


5.5.5 Quantum FOURIER Transform 


The quantum FOURIER transform [73] is an important part of several algorithms 
and serves as a further example how elementary gates can be used to build a unitary 
transformation. It is defined as an operator on the tensor product of the qubit space 
‘H as follows. 


Definition 5.48 The quantum FOURIER transform F on Н” is defined as 


the operator 
gei 


1 „ху 
F := —— ex (2212) х)(у|, 
= p p (27i; ) boo 
where |x) and |у) denote vectors of the computational basis of Н". 


In fact, as shown in Example F.52, the definition given above is a special case of 
the quantum FOURIER transform on groups given in Definition E51. 
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With the help of 


1 1 1 
| [1 œ ү 
F = —— . ; 
y2” : 
1 ө?-1 p 1)? 


Exercise 5.66 Show that F is unitary. 


For a solution see Solution 5.66. 


There is a connection between the quantum FOURIER transform and the discrete 
FOURIER transform used in signal-processing. 
Definition 5.49 Let N € N. The discrete FOURIER transform is a linear map 


Fis F (giu =? (С 
с +> Fiisle) 


defined component-wise by 


AS 2л1 
Fas(c)k = —= У, exp ay) 9: (5.124) 


For an arbitrary vector |) € Н” it then follows that the components of the 
quantum FOURIER transformed vector (F|V^), = (x|FY) in the computational 
basis are given by the discrete FOURIER transform Е, (с); of a vector c € C" that 
has the components c, = (x|V^). 


Lemma 5.50 Let n, N € N with N — 2" and 


2^—] 
|) = Y kp eme. 
х=0 
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Moreover, let c € CN be the vector with components c, = V, = (x|W) for 
x € (0,...,N — I). Then we have 


(k| FP) = Еаз(©) к o 


Proof One has 


21 2] 21 
FW) = LMR) = YR. У ер (2m2) le) 19 
Е (5.124) ^^ = RJ 
j 34 

= Y, ex zx | |Z 

m ES 

y 2л1 J 

= cyexp | —х | |z 
“ N 
N=2" cx =F, VN 2 
and thus 
p ox 27i j 4 27i 
(k|F') = — Cx exp (Fa) (k|z) = —= У cyexp (Fer) 
UN 2. N Ss VN 2 9 N 
m 
Map. dis (€); 
(5.124) 
We further introduce the following notation for binary fractions: 
Definition 5.51 For a;,...,a, Є {0,1} we define 
0.a142...a EUH = (5.125) 
NG ees oy 4 2m — 1 3 2 


With the help of this notation for binary fractions the quantum FOURIER trans- 
form can be represented as follows. 


240 5 Quantum Gates and Circuits for Elementary Calculations 


Lemma 5.52 Let n € N and 
п—1 Р 
= (5.126) 


where x; € {0,1, } for j € (0,...,n— 1). 
Then the action of the quantum FOURIER transform F on any vector |x) of 
the computational basis of H” can be written as 


їй = 
VE 


F\x) = fio) eros 1) | (5.127) 


Proof According to Definition 5.48 one has 


po! 2лї ) 
Е |х) = exp | = х 
DE PED 
j ^e 2лі 
= ехр EE Ve 1. --Yo) 


j=0 


ля % По (5 эп wa) [Yn-1---Y0) 


= 0 
= п Te т?!) & yx) 
М2" o- Уп- 1€{0, 1}7 =0 (S k-n-1 
1 0 


2лі 
= Vm У, G9 exp (Feo) lye) 
1 


yo---Yn—1€ {0,1} k2n-1 


0 7 
201 k 
= 5 9 X (mero 
2 Е и 2 


== 9 D ) J- exp (222) ш. (5.128) 


К=п—1 


In the last equation we further use (5.126) and the notation for binary fractions given 
in (5.125) in order to obtain 
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27i п—1 
ехр (20%) = ехр (2ni у ee) 
1=0 


n—k-1 п—1 
= exp (2лї| у ae у шы! 
1=0 l=n—k 
——" 
EN 
n—k-1 
— exp (2ni Y xp 
1=0 
.[ X0 X1 Xn—1—k 
= ep (2 щш! 
- e 2710, 1X0 . (5.129) 
Insertion of (5.129) into (5.128) then yields 
0 п—1 
Е|х) z 1 Q) |l) emite m — 1 Q) (l0) fooler . 
м2" К=п—1 v2" j=0 


We still need the following result for the HADAMARD transform if we want to 
express the quantum FOURIER transform with the help of elementary gates. 


Lemma 5.53 Let n € N and j € No with j < n and let |x) be a vector in the 
computational basis in H®”. Then 


|0) E е2710-у | 1) 
v» ? 


Hy) = (5.130) 


holds, and with | | 
H; := 1890-1) 9H Q1% (5.131) 


for j € (0,...,n— 1} one has 


|0) j е?Лї0-х) | 1) 


Н}|х) = |xn-1) ®---[ху+1) ® v 


Gx-1)9---G|xo). (5.132) 


Proof From (2.162) in Lemma 2.39 we know that 


0) + е) 
у, 


Н |х) = 
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holds. Then (5.130) follows from the Definition 5.51 of the binary fraction. 
The action of H; as claimed in (5.132) follows directly from definition (5.131) 
and (5.130). 


A further transformation needed to build the quantum FOURIER transform is the 
conditional phase shift. 


Definition 5.54 Let j,k € (0,...,n — 1} with j > К and define 6, :— 37. 
The conditional phase shift is a linear transformation on "H?" defined as 


Рд := 19 071-9 о |0)(0| 91% 
449-12) g fora П] 917 ә |1)(1|®1®*. 


The action of Pj; is an application of Ау (P(8j.)) on the (k+ 1)-th and (j+ 1)- 
th factor space in *H?" (see Figs. 5.4 and 5.5 for the definition of Ai (V) and P(a)). 
This can be illustrated if we consider the restriction onto the respective subspaces. 
Let ЇН denote the (k + 1)-th factor space counted from the right and "Н; the (j+ 1)- 
th factor space in "IH?" (see (3.18)). Furthermore, let 


10810), |0;6]0), 108]; [181x 


be the four vectors of the computational basis in H; © Hg. Then the matrix repre- 
sentation of the restriction to these two factor spaces is given by 


100 0 
010 0 

Pik tom, |001 0 = Au (P(85)) - 
0 0 0 eio 


The action of Pj, is thus only non-trivial if both states in the (j+ 1)-th as well as 
the (k + 1)-th factor space each have a non-vanishing component along |1) in which 
case it consists of a multiplication with a phase factor e? , Otherwise, Pj, leaves 
the total state unchanged, in other words, acts as the identity. 


Lemma 5.55 Let j,k € {0,...,n—1} withj >k and letl € (j4- 1,...,n— 1). 
Moreover, let |у) € “Н and Woj, yi; € C as well as xo,...,xj-1 € {0,1}. Then 
we have 
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Pg |Wn-1) 8-6 |у)  [woj]0) + yyl] @ |ху—1) @ +++ ® |ә) 


їл к. 
= |Wn-1) ® +++ ® |Wh41) ® [wy]0) + уе I= |1)] & |1) ®---%® |ә). 


Proof With |x,) = (1 —xx)|0) +xz|1) and 0j, = 52 one has 


Р |1) 9:9 |н) 9 [wg]0) + vij] D)] & pg-1) ®---® [xo) 
= (1— x)| Yn-1) 8: @|Wj41) 9 [wo;|0) + yjll)] 8 |xj-1) 8-8 |х) 
+ X¢|Wn—1) 8:6 | Whar) 9 [woj[0) + vie 9 |1)] & |xj-1) @ +++ @ [xo) 


in 2k 
= |Vn-1) 9: Цун) 9 [Woj|0) + ye” 9 * |1)] |) Ә-Ә [xo)- 


Up to a re-ordering, that is, a reversal of the factors in the nth fold tensor product 
*H*". the quantum FOURIER transform can be built as a product of HADAMARD 
transforms and conditional phase shifts. 


Theorem 5.56 The quantum FOURIER transform F can be built from the 
swap operator S un defined in (5.30), HADAMARD transforms and conditional 
phase shifts as follows: 


п—1 =й 
run (Tis н) (5.133) 


j=0 


= S™ HoP: oH P20P2,1H2..-Pn 1,0 Pa 1,i-2Hg—1 - 


Proof With (5.132) we have at first 


|0) ie e27i0.xn-1 |1) 


v2 


According to Lemma 5.55, this implies 


H,ya|x) = 8 |xn-2) 8 +- @ |х). 


Xn-2 


roD 


|0) af е2лїб.х„_1+!л 


у, 
0 p e27i0 3,1342 1 
= 0 | ) s, 2) @ +++ o) 


v2 


Pr—1n—2Hn—1|x) = 8 |xn-2) 8:8 |х) 


and 
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P, 10Р 11...РҺ ln 2H, 1|x) 


0 p e2i0-%n—1---X0| J 
210) D eris rei 


v2 


Furthermore, 


Hy—2P n—1,0Pn—1,1 -» + Pn—1,n—-2Hn—1 |x) 


0 p e27103,—1...30|1 0 4 e2710-%n—2| ] 
aw Ш q, 1) IU Jan) 8-8 [xo) 


v2 v2 


and 


Разрад Pata sn oO piel a Ra |x) 
0 p e27i0 x41... 1 0 -- e27i0-%n—2---X0 1 
_ 10) He) I electis b 


v2 v2 


Similarly, a repeated application to the remaining tensor products |x,_3) ® --- Q |xo) 
then yields 


n—1 f j-1 0 . 
(Пион) D=- Q [(0) +е#”0ж--|) ; (5.134) 


k=0 k-n-1 


This is Е |х) up to an inversion of the sequence of the factor spaces. Thus, we have 
finally 


К=п—1 


п—1 


n-1 []—1 0 | 
NU П (П оди) |х) 5 ih Q 10) eror) 
1 


10) ES е2710-хк---х0 | 1)| 


Figure 5.24 shows the circuit comprised of gates, which generate the quantum 
FOURIER transform. 

The representation (5.133) of Е |х) with the help of Н;,Рз and S (^) allows us, 
to provide bounds for the growth rate of the computational steps required for the 
quantum FOURIER transform. 
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Fig. 5.24 Quantum circuit to build the quantum FOURIER transform with the help of HADAMARD 
gates, conditional phase shifts and swap gates 


Corollary 5.57 Let Е be the quantum FOURIER transform on HS”. Then the 


number of required computational steps Sr to perform F as a function of n 
satisfies 


Sr(n) € O(n’) for n — ee. 


Proof The application of Н; and Ру each require a fixed number of computational 
steps independent of n: Sy, (n), Sp, (n) € O(1). The application of 5 (^) requires 
instead Sg) (n) € O(n) steps for n — œ. Because of (5.133) from Theorem 5.56 
we can perform F by 


an n-fold application of H; for j € (0,...,n — 1}, with Sg (n) € O(n), 
+ an nn=)) fold application of Pj, for j € (0,...,n— 1} and k € (0,...,j— 1} 
with Sp(n) € О(п?) 


+  asingle application of § with Ss (n) € O(n). 
Hence, we find for the number of computational steps Sr to perform F 


Sr (n) = Su (n) +Sp(n) + Sge) (n) um O(n’) 
С.3 


as claimed. 


5.6 Further Reading 


One of the earlier introductions to quantum gates can be found in the paper by 
DEUTSCH [17]. This paper already addresses the question of universality which is 
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discussed in more detail in the paper by BARENCO et al. [30]. Gates for explicit 
arithmetic operations up to modular exponentiation were presented by VEDRAL et 
al. [72]. 

Many quantum gates and circuits for various applications can found in the intro- 
ductory text by MERMIN [74] as well as in the comprehensive and wide ranging 
book by NIELSEN and CHUANG [61]. 


Chapter 6 A) 
On the Use of Entanglement get 


6.1 Early Promise: DEUTSCH-JOZSA Algorithm 


In 1992 DEUTSCH and JOZSA [75] devised a problem and a quantum algorithm 
for solving it, which showed how dramatically more efficient than their classical 
counterparts quantum algorithms could be. This problem has since become known 
as DEUTSCH's problem! and the quantum algorithm to solve it efficiently as the 
DEUTSCH-JOZSA algorithm. 


Definition 6.1 (Deutsch's Problem) Let n € N and f : (0,1)" — {0,1} bea 
function of which we know that it is 


either constant, that is, 
f(x) = сє (0,1) for all x € (0, 11" 
or balanced, that is, 


(= 0 for one half of the x € {0,1}" 
— |1 for the other half of the x € (0, 1)" 


DEUTSCH’ S Problem is to find the most efficient way to decide with certainty 
whether f is constant or balanced. 


We measure efficiency of a method by the number of function calls, that is, by the 
number of evaluations of f or related objects that have to be made to gain absolute 
certainty. We may visualize this by being able to submit queries to f via a keyboard. 


! Named after him because DEUTSCH [16] had first considered a version of it already in 1985. 
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In order to ascertain whether f is constant or balanced, any classical method will 
require at least 2"—! +1 queries. Only then can we be convinced about f being 
constant or balanced. 

In contrast, the quantum algorithm devised by DEUTSCH and JOZSA [75] requires 
just one application of a suitably implemented unitary operator Uy of the form 
(5.84). In other words, if the keyboard were connected to a quantum computer that 
has a circuit implementing Uy, we would need to enter only one query (that is, one 
execution of Uy) to ascertain which type f is. 


Proposition 6.2 Let f be as in Definition 6.1 and 
Uy: H” 9 H —— H” co Н 
2 (6.1) 
Ix) @ly) — |x) @ly ® f(a). 


Then there is a quantum algorithm which uses only one application of Ug and 
solves DEUTSCH’s problem. 


Proof We devise an algorithm that solves the problem with only one application of 
Оу as follows. Recall from (5.83) that the HADAMARD transform satisfies 


1 2”—1 
H®”|0) = 27 2 2 les (6.2) 


Moreover, for any computational basis vector |x) the action of H®” can be expressed 
as given in Exercise 6.67. 


Exercise 6.67 Show that 


1 


H®” |x) = = 
22 


ES 


P уу), (6.3) 


where we set for ће computational basis vectors |х) and |у) 


2 2 2 
X O y :— хһ-1уп-1 ©... B хоуо. 


For a solution see Solution 6.67 
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The algorithm initially operates on the composite system H4 @ HË, where H4 = 
"Н" and HË = *Н and starts with the initial state 


10) 


– |1 
ш) = 10" o Т ЄєН^®Н#. 


In the next step in the algorithm we apply (Н®" & 1)U; (H?" ®1) to obtain 
IA) = (H”81)U(H™ e) 


= (H*"gi)U; Cu ® E 


= (n9^glU (à : Y We o) 
_— f fh 


2^—1 


(н® @1) 


(иу) ® 10) — 13.812) 


nl 
2 


=0 
2*1 


(н®"® == x) ® (1f) — [1 Ф f())) 


= (н®" 91) 43 x) & (- 1/9 (|0) — |1)) 


—1 
opaga = 
r э, (не 5 


on 0) - |1) 
- 1 Р(х) +хӧу 9 | | 
x EC wea 


Note that 2-19 = | |x) is one of ће two basis states | 15) and | |) in H so that 


|Ф\) can be written as 
1) = 90) e| Ls), 


where 
H 2"—1 


Me. xL 95у). 


ое 0 


Consequently, the density operator of ће complete system is 


py, = MH = He a) (EiS Ls | = IT) CHI] Ls) Us | 
(2.89) (3.36) 
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and using (3.57) with tr (| |) (|s |) = 1 we have 


p^ (pw), — tt" (pu), = M) Ий = pue. 


(3.50) (3.57) (2.89) 


This shows that when now considering the sub-system A alone, it is described by 
the pure state 


wA =L y caer у (Әр). (64) 


The probability to find system A in the state |0) € IH^ is given by 
SystemAis in "m 12d fo) А 
= = бшк a x 
2r state |0) } = 1001 )| S| an > ( 1) (6.5) 
(2.64) (6.4) xm 
(+ xc Cy) —] if f is constant 
2" 4ix=0 on 


(4,(2"-!-2"-1))? =0 if fis balanced 


Hence, measuring Po = |0)(0| in the state [\Р{\), which we have produced by only 
one application of Uy, will reveal if f is constant or balanced. 


On a step-by-step basis the DEUTSCH-JOZSA algorithm then runs essentially as 
follows: 


DEUTSCH-JOZSA algorithm 


Input: A function f : (0,1)" — {0,1} that is either constant or balanced and 
an associated (/ғ acting as 


Оу: H” 9 H —— "IH" eH 
2 
Ix) @|y) — |x) УФ (8) 


and we set H^ = "Н®" and H? = #Н. 
Step 1: Prepare the initial state 


|0) — |1) 
v2 


Step2: Apply (H^" & 1) U;j(H^" & 1) to |%) to obtain 


|) = |0" 8 c H^ eH? 


|1) = (Н®" exu (H?" ®1)|чу). 
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Step 3: Ignoring sub-system B, the sub-system А is then in the pure state |^) € 
НА given in (6.4). Query the sub-system A for the presence of |0) € H4 
by measuring the observable Po, = |0) (0| in the state |^) and use the 
observed value together with (6.5) to ascertain 


2 ] then f is constant 
P = tp = 
( 0) we K pa ) | then f is balanced 


Output: Determination whether f is constant or balanced. 


Hence, the DEUTSCH-JOZSA algorithm reduces the 2"! + 1 evaluations of the 
function f, which are required by a classical way to solve DEUTSCH’s problem with 
certainty, to just one application of Ur. 

However, for the quantum algorithm to be more efficient than the many classical 
evaluations of f, we need to be able to build and run the quantum algorithm in much 
less than 2" + 1 steps. In other words, for efficiency gains Uy has to be such that it 
can be build and run in much less than 2" 4- 1 steps. In particular, this excludes that 
the knowledge of all f(x) would be required to build Шу. After all, there would be 
no point in running any algorithm if we knew all values of f already. 

Despite these caveats, the DEUTSCH-JOZSA algorithm clearly signaled—albeit 
on what some might consider a Чоу problem—that quantum algorithms had the 
potential to vastly outperform classical algorithms. Before we turn to quantum algo- 
rithms solving problems more pertinent to “everyday life, we present two applica- 
tions of entanglement which are both curious and interesting in their own right. 


6.2 Dense Quantum Coding 


If Alice and Bob each have at their disposal? qubits that constitute the parts of a 
total system that was prepared in an entangled state, they can use this to transmit 
two classical bits by only sending one qubit. This procedure of transmitting two 
classical bits by means of sending one qubit is called dense quantum coding [76]. 

Suppose then Alice and Bob each have a qubit of a two-qubit composite system 
that is in the entangled BELL state 


1 
/2 
Depending on which of the four bit-pairs xixo € {00,01,10,11} Alice wants to 


send to Bob, she performs on her qubit a unitary transformation U^ = U^(xixo) 
according to the following assignment 


Ф) = — (100) + |11)) . 


? Having a system at their disposal means that they can apply transformations or measurements to 
it. 
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Table 6.1 Protocol of dense quantum coding 


Alice wants to send So she applies The state of the total | on which Bob 

the classical bits хухо | U^ (x1xo) system becomes measures of & o? and 
( U^g 1) |Ф+) с^ @ oË and observes 

the values 

00 1^ |Ф+) T1,41 

01 o? |87) SL 

10 o? E= —1,41 

11 of oA |7) -1,-1 


U^ (00) — 1^ 

U^(01) — o? 

U^(10) = of = 
U^(11) = 0404 


Table 6.1 shows in the first two columns which of the four possible choices of U4 
listed in (6.6) corresponds to which pair of bits. In applying U^, she transforms the 
total state |^) to one of the four BELL states |^) and |У). For example, if she 
wants to transmit the bit-pair 01, she would apply o^ to her qubit and thus transform 
the total state | ^) to 


1 
5 


(of. 91°) |@*) = — (tef) &10) (o1) eI) = = (100) — [11)) = 16^). 


1 
v2 


Exercise 6.68 Show that U^ @ 18 with U^ € {14,04,04, 0404} is unitary and 
verify 


(afe1*)|@*) = je) 
(e^o @1°)|@*) =|). 


For a solution see Solution 6.68 


Alice thus encodes two classical bits in her selection of U4 and by application of 
the selected transformation to her qubit. She then sends her (one) qubit to Bob, 
who then has both qubits at his disposal. On these, he measures the compatible 
observables o? e p. and o? e ор (see (3.41)). Reading off the observed value- 
pair out of {+1,+1} and using the correspondence given in Table 2.1, he can thus 
uniquely determine the bit-pair Alice has sent. 


j= 
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ХІ Ф 

Xo 
4 
H " x dz Pinos E 
Se 0; 80; X 
HË 0 


Fig. 6.1 Graphical illustration of the process of dense quantum coding; the inputs хо and x; are 
classical bits, which are graphically represented as lines with rectangular humps. They control the 
application of X and Z on "H^. Here, X will only be applied if x; = 1. Analogously, Z will only 
be applied if хо = 1. This is akin to the application of X*!Z* on "НА. The values observed by 
measuring 0? Q o? and of & o? are translated into the classical bits x1, xo according to Table 2.1 


This protocol is illustrated in Table 6.1, where we make use of Tables 2.1 and 
3.1. Altogether Bob has read two classical bits, even though he only received one 
qubit from Alice. А further illustration of this process in form of a circuit diagram 
is given in Fig. 6.1. 

It should be noted, however, that this condensed transmission of classical infor- 
mation presupposes that Alice and Bob each already have received qubits which 
constitute the parts of a total system in an entangled state. This is in addition to the 
qubit actually sent from Alice to Bob. In a sense they thus share some form of joint 
‘information’, that is, each already has a qubit of an entangled state, prior to the 
qubit sent from Alice to Bob. 


6.3 Teleportation 


In what has become known as teleportation [18] we have essentially the inverse 
of dense quantum coding: if Alice and Bob each have a qubit at their disposal that 
is part of a total quantum system in an entangled state, then one qubit can be trans- 
ferred (aka *teleported") from Alice to Bob by sending two classical bits. Again, this 
procedure uses entanglement as the most important ingredient and runs as follows. 

Suppose Alice wants to teleport the qubit |y)? = a|0) + »|1) € ‘HIS to Bob, and 
she has another qubit that is part of an entangled BELL state 


1 
|Ф+уйв = a (lo^ ә |0)# + |^ | )^) ete. 
Moreover, suppose the other qubit of this BELL state is with Bob. She then combines 


the qubit to be teleported with the one that is part of the BELL state and performs 
measurements on the system in the HILBERT space "IH? & НА. 
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For the total system, the addition of the sub-system to be teleported means that a 


new total system has been formed, which is described by vectors in "IH? @ "НА @ "IH? 
and which is in the state 


у)? olot" = (40-4105) & 7 (Io eo - I^ ein) 


1 
= — a |0) ә10)^  sjo^-a joe] |n? 
V2 en —— 
=F (|+)544\-)54) =» (+) 5л) 


+b |0) go)? +b |ә) әј) 
=, (+) -)) =. (Ie*)9*-|0-)5^) 

ПФ *)9^ & (а10)8 +618) + 18+) e (ај1)2 + sj?) 
Ф) ә (ao? — 51?) +m)“ (a1)? —50*)] 
[9*9 e qv)? + 5 e (of ly)? (67) 


o=“ (sli?) +17) (sto?) 


Alice now measures the compatible observables o? ® од апа о? e о (вее (3.41)) 
on the composite system “НЗ @ ‘H4 formed by the qubit to be teleported and her 
qubit, which is part of the composite system in the entangled BELL state. According 
to the Projection Postulate 3 in Sect. 2.3.1, the measurement of these observables 
projects onto one of the four eigenstates |. *)5^, |Ф-)5, [PHYSA and |W—)5^. From 
the observed values for o? & o2 and 6? & 04, Alice can thus read off in which of 
the four states appearing in (6.7) the total system is after the measurement (see 
Table 3.1). Depending on which values she has observed, she sends two classical 
bits хухо to Bob, which instruct him to perform on his qubit a unitary transformation 
U® = UP (x1xo) according to the following assignment 


+ Nie 4+ NIK 


U? (00) = 18 
U?(01) = o? 
UP(10) = ор 
U*(11) = ойор, 


which is identical to (6.6) used by Alice in the dense coding protocol. Because of 
1° = (оу)? = (о)? = 0,0,0,0; = 1, this transforms his qubit to the state |y). This 
procedure is illustrated in Table 6.2. The quantum state | y) is thus ‘teleported’ from 
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Table 6.2 Protocol for teleportation 


Alice measures The three-qubit total | From bits received The state of Bob's 
o$ 02 and о? @ of | state after Bob determines to qubit then becomes 
to observe measurement is then: | apply U? 

|¥)54 & Bob's 

qubit-state 


+1, +1 |B") & |у) 15 (18)2 |) = |v) 
+1,—1 (97) @ o?|v) o? (98)2 р) = |у) 
=1,41 |+) сву) ge (98)2 р) = |w) 
Е |7) о2о? |у) ofo? of of ofo2|w) = |) 

шэ)  — o ® o^ é 

9 g CEPS 

HA —1 

& э|Ф+) | 

H? X Z |у) 


Fig. 6.2 Graphical illustration of the process of teleportation; the results of the measurements аге 
classical bits, which again are graphically represented as lines with rectangular humps. They are 
used to determine the respective application of X or Z in the sense that X is applied to "IH? only if 
the measurement of 6? & o? yields the value +1, which according to Table 2.1 corresponds to the 
classical bit value 0. Analogously, Z is applied to "НЗ only if the measurement of 0? & с^ yields 
the value +1 


Alice to Bob, even though only classical information has been sent from Alice to 
Bob. However, just as in the case of dense coding, here too, the requirement for 
this to work is that Alice and Bob already share some kind of joint information in 
the form of a supply of qubits that are sub-systems of a total system that is in an 
entangled state. Moreover, it has to be emphasized, that the state |y) is not cloned, 
which would contradict the Quantum No-Cloning Theorem 4.11. Instead, this state 
is destroyed by Alice's measurement, before it is re-generated by Bob through appli- 
cation of a suitable UP. 
Figure 6.2 shows a circuit diagram of the process of teleportation. 


6.4 Quantum Cryptography 


6.4.1 Ciphers in Cryptography 


Cryptography is the science of encrypting and decrypting messages m € M, where 
M is a finite set of possible messages. Encrypting a plaintext message m means 
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transforming it into an alternative form c € C called ciphertext that does not allow to 
retrieve the plaintext m without additional knowledge of some sort. This additional 
knowledge is what we call a key k € К. 


Definition 6.3 Let M, C,K be finite sets. A cipher is a cryptographic proto- 
col encrypting plaintexts m € M with a key k € K and consists of an encryp- 
tion 
e: KxXM — C 
(k,m) — e(k,m) 


mapping the key-plaintext pair (К, т) to some ciphertext e(k,m) and a decryp- 
tion 
d:KxC—M 
(k,c) —— d(k,c) 


mapping the key-ciphertext pair (k,c) to some plaintext d(k,c) such that for 
allm c Mandkc К 
d(k,e(k,m)) =m. (6.8) 


If encryption and decryption use the same key К, the cipher is called sym- 
metric. If one part kpub of the the key k = (Ару, kpub) is used for encryption 
m+ e(kpyp,m) and another part ky, is used for decryption c > d(kpriy,c), 
then the cipher is said to be asymmetric. 


Effectively, d is the inverse of e. More precisely, if we look at 
ekl) :2e(k,-.): M— C and d(-):=d(k,-): CoM 


then (6.8) implies that 
dy oeg = idw . 


As our digital world amply demonstrates, there is no loss of generality if we assume 
each message to be a binary string (mj, 1... mo) of a fixed length пм with m; € 
{0, 1}. Using the m; as coefficients in a binary expansion, we can thus consider each 
message to be an integer т satisfying 


пм—1 ; 
0<т= Y т;2/<2"М—1. 
j=0 


Likewise, we may assume the ciphertext to be a binary string of length nc and a 
natural number c satisfying 0 < c < 2"С — 1. Sometimes—but not always—the key 
К is taken to be of the same form with length пк and 0 € k < 2"K — 1. 
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The ciphertext, that is, the encrypted message c = e(k,m), may be transmitted 
on public channels. A secure cipher would make it impossible to retrieve m from c 
without knowing k. 


Example 6.4 One cipher, which meets this criteria, is the VERNAM cipher also used 
by CHE GUEVARA and FIDEL CASTRO [77]. This is a symmetric cipher where 
plaintext, key and ciphertext all have the same length nm = nk = пс = п. The key 
k is arandom bit-sequence 

К = (ky-1,...,ko)- 


Encryption is accomplished by addition modulo 2 of the key-bits k; to the plaintext- 
bits т ;. With the help of the notation introduced in Definition 5.2 we can thus write 
the encryption map as 


2 
e(k,m) = (ki Bimy-1,.--,ko © mo) А 


The ciphertext с = e(k,m) is then a purely random sequence of bits and does not 
allow to obtain any information of the original plaintext т. In order to decrypt the 
ciphertext, one requires the key k. With the key decryption is accomplished by once 
again adding modulo 2 to the key-bits to the ciphertext-bits: 


d(k,e(k,m)) = (kn-1  e(k,m)n—1,--.ko ® e(k,m)o) 


2 2 2 2 
= (Ka D п1 © m, 1,..., ko © ko © mo) 
= (mp—1,---,™M0) 


2 
since k; © kj = 0 for all k; € {0,1}. This is illustrated with a small example in 
Table 6.3. 


The VERNAM cipher is absolutely secure, but has the disadvantage that, in order 
to maintain its security for every message, we need to use a new key for each new 
message. Hence, sender and receiver either need to have a large common supply of 
random key-bits or need to exchange such bits every time they want to exchange 
a message. The former requires to keep this large supply safe, whereas the latter 
requires a secure transmission channel, something we are trying to establish in the 
first place. 

Quantum mechanics, however, does offer the possibility to generate a random 
key-bit-sequence, to transmit it and to check if the transmission has been compro- 
mised in the sense that eavesdropping occurred. Thus, even though we cannot pre- 
vent eavesdropping, we can at least detect it. In case we detect eavesdropping, we 
do not use the bit-sequence as a random key. This is called quantum (cryptographic) 
key distribution. 
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Table 6.3 Sample en- and decryption with the VERNAM cipher 


Decryption 


Т 
L 
Key k= 1 
Message m=0 


There are several protocols of quantum key distribution. In Sect. 6.4.2 we first 
consider a procedure that—contrary to the title of this chapter—does not use entan- 
glement. Instead, it is based on the quantum mechanical phenomenon that in general 
an observation, which can only result from a measurement, changes the state of the 
observed system. In Sect. 6.4.3 we then exhibit a protocol which does utilize entan- 
glement in that it makes use of the fact that the EPR correlations of BELL states 
cannot be generated by classical random variables. These protocols are two exam- 
ples of what has become known as quantum cryptography. 

The currently most widespread classical cryptographic protocol is the asymmet- 
ric cipher developed in 1978 by RIVEST, SHAMIR and ADLEMAN [78, 79], which 
works with one part of the key being publicly known. This has since become known 
as the RSA protocol, and we study it in more detail in Sect. 6.4.4. Its security relies 
on the fact that, so far, it is too time-consuming to find the prime factors p and q of 
a large number N — pq. 

However, in Sect. 6.5 we present a quantum algorithm devised by SHOR, which— 
if quantum computers are realized—allows to find prime factors much faster than 
hitherto possible. Hence, quantum mechanics on the one hand would allow to com- 
promise the security of RSA, while on the other hand permits to create key distribu- 
tion protocols such as those presented in Sects. 6.4.2 and 6.4.3, which allow at least 
the detection of eavesdropping. 


6.4.2 Quantum Key Distribution without Entanglement 


The following method to distribute a random bit sequence, which can be used as 
an encryption key for the VERNAM-Code, was proposed in 1984 by BENNETT and 
BRASSARD [1]. The protocol is thus denoted by the acronym ВВ84. It does not use 
entanglement but instead relies on the fact that in quantum mechanics measurements 
alter the state in order to detect eavesdropping. 
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The objective of the method is to generate a random bit sequence that is only 
known to Alice and Bob and for which they can check if the transmission has been 
listened to. This is achieved as follows. 

Suppose Alice has a large number of qubits at her disposal. For each of them, she 
randomly selects to measure either o; or Oy. For each qubit, she records the measure- 
ment result and then sends the qubit to Bob. He, too, randomly selects to measure 
either o; or o, on the qubit received and also records the measurement result. Alice 
and Bob then communicate via public channels for which of the qubits they hap- 
pened to have measured the same observable, that is, either both o; or both Ox. For 
those qubits, the measurement results have to be the same. This is because, due to the 
Projection Postulate 3, after the measurement of Alice, the qubit is in an eigenstate 
of the measured observable corresponding to the observed eigenvalue. A measure- 
ment of the same observable by Bob on the qubit in that eigenstate will result in 
the same eigenvalue to be observed as a result of the measurement. From this set 
of qubits, where they have measured the same observable, Alice and Bob select a 
subset and publicly compare their measurement results. We shall show below that, 
if these measurement results all agree, they can be (almost) certain that no third 
party has gained knowledge of these measured values. In this case they can use the 
measured values of those remaining qubits for which they have measured the same 
observable, but have not not compared the measurement results, as a random bit 
sequence only known to them. Table 6.4 illustrates the protocol under the assump- 
tion that no attempt to intercept the information (aka eavesdropping) has been made. 

What then, changes if Eve intercepts the qubits on the way from Alice to Bob 
and attempts to listen in? The information that Eve wants to get is the random bit- 
sequence that Alice and Bob have generated as outlined above. The only way for Eve 
to get that information is to actually measure one? of the incompatible observables 
O; or Oy. Since Alice randomly selects one of the incompatible observables o; or 
Ox, and Eve does not know which she has selected, Eve will not always happen to 
measure the same observable that Alice measured. 

For those qubits where Eve happens to measure the same observable as Alice, 
Eve will indeed observe the same value as Alice since the qubit arrives in an 
eigenstate of the observable. Moreover, this state will not be altered by Eve's 
measurement. 

However, in those cases where Eve happens to measure a different observable 
from the one Alice measured, the measurements by Eve will change the state of 
some qubit because the two observables in question are incompatible. Hence, in 
these cases the qubit arriving at Bob is in a different state from that which Alice 
prepared. Consequently, the comparison by Alice and Bob of the values measured 
in case they chose the same observable will reveal disagreeing values for a number 
of qubits beyond what might reasonably be expected due to transmission errors. 
Alice and Bob thus conclude that somebody has intercepted the qubits. Hence, they 
do not use them but start all over again. Table 6.5 illustrates the protocol BB84 with 
eavesdropping. 


3Measuring both does not yield useful information for Eve because the observables are 
incompatible. 


260 6 On the Use of Entanglement 


Table 6.4 Key distribution without eavesdropping according to BB84 


For qubit no. 1 2 3 4 Э 6 7 8 9 10 11 12 


Alice chooses randomly one of the observables o; or oy. Suppose 
she measures 
Alice's observable Oy Ox O О; Ox о, О, О; б; Ox Ox Oz 
and observes 
Alice’s value +1 —1 —1 +1 +1 -1 +1 —1 +1 +1 +1 +1 


The qubit is then in the 
qubit state | Tg) | le) | le) 112) | Ta) Ide) ITa) |le) 112 |1) ITa) | 12) 


Alice sends the qubits thus prepared to Bob. He chooses for each qubit 
randomly one of the observables o; or Oy. Suppose he measures 


Bob’s observable б. Ox 0; 0; O; Oy Oo O; Oy бу Q О; 
and observes 
Bob’s value -1 1—1 [41 (+1 = +1 [21-1 (41 -1 xi 
Alice and Bob publicly compare for which qubit they have measured 
which observable. But they do not reveal the outcome of the measure- 


ment, that is, the observed value. They thus divide the qubits into a set 


where they chose either the same observable or different ones. Measured 


observables were 


If they have chosen the same observable, their measured values have to 
agree. As a control they compare publicly every second of the observed 
values where they measured the same observable: 
control-value Alice +1 —1 +1 
control-value Bob +1 —1 +1 


100% agreement in comparison of control values implies: 

with a probability increasing with the number of control values the 
qubits have not been read between the measurements by Alice and Bob. 
Use the observed values in the remaining cases where both measured 
the same observable as joint, secret, and random 


bit sequence: -1 -1 +1 
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Table 6.5 Key distribution with eavesdropping according to BB84 


For qubit no. 1 2 3 4 5 6 7 8 9 10 11 12 


Alice randomly selects one of the observables о; or Oy and measures 


Alice's observable Oy Ox O © Ox O О, О; б; Ox O б; 


and observes 
Alice’s value +1 —1 —1 +1 +1 -1 +1 -1 +1 +1 +1 +l 


The qubit is then in the 
qubit state | Tg) | le) | le) 112) |fe) | le) ITa) 112) 112) 112) 112) 112) 


Alice sends the thus prepared qubits to Bob. Eve intercepts the qubit, 
but does not know, in which state it is. Thus, Eve measures 


Eve’s observable 0, Ox Ox O O Ox Oo Oy Oy Oy Q О; 


and observes 
Eve’s value -1 —1 -1 +l 1 1 +1 1 +1 +1 +1 +1 


The qubit is then in the 
qubit state | |а) | le) | le) |1) | la) | le) |1) |) | Te) ITa) 112) | ta) 


and is passed on from Eve to Bob. He randomly selects one of the 
observables 0; or Oy and measures 


Bob’s observable б. Ox 0; 0; O; Oy о, O; Oy Oy Q GO; 


He observes 
Bob’s value —1 —1 —1 +1 -1 —1 +1 +1 +1 +1 +1 +1 


Alice and Bob publicly compare for which qubit they have measured 
which observable. But they do not reveal the outcome of the measure- 
ment, that is, the observed value. They thus divide the qubits into a set 


where they chose either the same observable or different ones. Measured 


observables were 


If they have chosen the same observable, their measured values have to 
agree and as a control they compare publicly every second of the 
observed values where they measured the same observable: 
control-value Alice +1 —1 +1 
control-value Bob +1 +1 +1 


33% disagreement in the control values implies eavesdropping. 


Discard all qubits sent and start all over with a new sequence. 
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Protocol BB84 does not allow to prevent eavesdropping per se, but it has a built- 
in strategy to detect it and thus avoid it. The security against eavesdropping in 
protocol BB84 rests on the fact that in quantum mechanics the measurement of an 
observable changes the state, and that, in general, it is impossible to restore the state 
prior to measurement unless it was known (in which case eavesdropping would have 
unnecessary). This is in contrast to classical bits, which can be read without altering 
them irreversibly. 

The communication of the key, that is, the bit sequence, in protocol BB84 
requires that qubits be sent from Alice to Bob without their state being altered since 
modification to the state is taken as proof of eavesdropping. Such an undisturbed 
delivery of qubits can be quite difficult in practice as it is notoriously difficult to iso- 
late qubits from external disturbances in the environment and for the time required 
in everyday applications. The alternative presented in Sect. 6.4.3 uses entanglement 
and avoids the delivery of qubits during the generation of the key. 


6.4.3 Quantum Key Distribution with Entanglement 


In the following we describe how entanglement can be utilized to distribute keys 
in such a way that no qubits need to be sent, provided Alice and Bob each have a 
supply of single qubits that are part of a composite system in an entangled state. This 
protocol exploits the CHSH version of the BELL inequality to detect eavesdropping. 
It was first proposed in 1991 by EKERT [3], which is why we denote it by the 
acronym EK91. 

Suppose Alice and Bob each have qubits that are part of a set of composite two- 
qubit systems that are prepared in the entangled BELL state 


_ 1 
ká ) = 00e- = 0178) 9 La) - | La) @| Ta) » 


(4.25) 


where, due to the result (4.25), any direction fi € Shs can be chosen to describe 
the state. To avoid sending qubits, Alice and Bob could each pick up their qubit at a 
time of their choosing from the source, which produces the composite system in the 
state |4). The protocol then proceeds as follows. 

Alice measures ХА, = fi^ . с on her qubits by randomly selecting for each qubit 
a direction fi^ from one of the three directions in (tl, &?, ^, where the ñ’ are 
as defined in (4.38) together with (4.40) and shown in Fig. 4.1. For each qubit, 


she randomly selects one of these three directions to measure PE For each of his 
qubits, Bob also randomly selects a direction fi? from one of the three directions 
in (i^, ar at} and measures хв, on each of his qubits. Table 6.6 shows a fictitious 
set of selected directions together with measurement results. For each pair of qubits 


4 Although permanent eavesdropping would prevent an exchange of keys. 
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Table 6.6 Fictitious measurements by Alice and Bob in the protocol EK91 without eavesdrop- 
ping. The cells in light gray show the results for qubits, where Alice and Bob have measured D 


and х2, in different directions &^ 52 АВ and for which they have publicly announced their mea- 
surement results. With these results the left side of (4.41) can be calculated as given in (4.42). The 
values shown here yield ~ —2,/2, which rules out eavesdropping. The cells in white, on the other 
hand, show measurement results, where they have measured p and P in the same directions 


fi^ = ñ? . These results are only known to Alice and Bob, and can be used as a random bit-sequence 


qubit- Alice Bob qubit- Alice Bob 
pair] measures z4, measures X4, pair} measures 24, measures X4, 
no. |in direction fi^ = іп direction й? = no. in direction fi^ = |in direction ñ? = 
Fu ñe ñt й? й2 ñt Fu ru ñt й? ñe ñt 


В 

r 
: 
E 
" 


E Ё 
аи 
E 


Ё 
E 


— 


ER Ви Вр 


E ВЕ ВЕЕ 


264 6 Onthe Use of Entanglement 


belonging to the same entangled state, Alice and Bob then inform each other via a 
public channel in which directions fi^ and й? they have measured Ул, апа х2, for 
each of their respective qubits in an entangled pair. However, they keep the observed 
values, that is, the measurement results, secret. They divide the measurements (or 
qubit-pairs) into two disjoint sets: 


e one set, where they happened to have measured in the same direction 
=й ог n =n 


e aseparate set, given by those measurement-pairs for which they happened to have 
measured in different directions fi^ 52 P. 


For the set where they have measured in the same direction, Alice and Bob will 
always have measured different values as their qubits are parts of the composite 
system in the state |V^ ). In other words, when Alice has observed the value +1 for 
her qubit, Bob will have observed —1 for his and vice versa. To see this, suppose 
Alice measures the spin in the direction fi? and observes the value +1 (‘spin-up’). 
The projector onto the corresponding eigenspace in the composite system is 


Peo 1 =| Taz) (Taz | 1. 


From the Projection Postulate 3 we know that Alice’s measurement projects the 
original state 


1 


I") — 5 (| Та?) &| ә) -| La?) &| РУ) (6.9) 
(4.25 
onto 
Pg v) (tg (Taz | 8 1) jV) 
V,» == ? п п = | [2 22), 
Fae +1) Poe, eal”) [| (I Ta2) (Taz | @ 1) || | Tae) 8 | Lae) 


Т2) (Таг | 19) ®| 442) - | m (Та | 1g2) 8| Та2)) 
—— 


=0 


This means that Bob's system will be described by the reduced density operator 
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P^ (Nae (Че) Sot (о а) (Җә) 

w^ ((| Tae) 81 Lad) (Ce 1® (La? D) 

t^ (| Tae) (Tae 1 | Lag) 2 0) 


к To) е D) | Lge) (Lae | 


which is the density operator of the pure state | | 2). If Bob measures in the same 


direction fi”, he will observe the value —1, since the state | 1g2) is an eigenvec- 
tor of the observable x, with eigenvalue —1. Analogously, we find that Bob will 
always observe the value +1 for his qubit if Alice has measured the value —1 on 
her qubit. Hence, in the set of identical measurement directions the measurement 
results of Alice and Bob are always (with certainty, that is) opposite to each other. 
Since the measurement results are only known to them, they can thus use this set of 
measurement results as a random and secret bit-sequence. 

How could an eavesdropper called Eve possibly compromise the security of this 
exchange and listen in? There are two ways for her to do this: the first consists of 
performing measurements on at least one of the qubits of the entangled pair dis- 
tributed to Alice and Bob; the second consists of manipulating the source of the 
qubit-pair in such a way that she knows the states in which the qubits sent to Alice 
and Bob are in. In the following we look at these possibilities in turn. 

Alice and Bob do not exchange any qubits, hence, Eve cannot intercept anything. 
Before Alice or Bob have performed measurements, the pair of qubits is in the entan- 
gled state |3). The joint information, which Alice and Bob share, comes only into 
being after their measurements. It is not available before that. We can assume that, 
after their measurements, Alice and Bob dispose of their qubits so that no further 
measurements can be performed on them. Hence, the only way for Eve to attempt to 
access any information by a measurement is to observe, that is, to measure, the qubit 
of Alice or Bob (or even both) before they perform their measurements. But after 
any measurement by Eve, the qubits are no longer in an entangled state |'¥~ ), just as 
is the case after any measurements by Alice or Bob. Instead, after any measurement 
by Eve, the qubits are in a separable state of the form | fae) S | Lavi) =: |ф Vi) 
for some directions f?! and ñ”! that Eve has chosen. 

If Eve would want to avoid making measurements, the only other way for her 
to compromise the secrecy of the bit-sequence, would be for her to manipulate the 
original composite state. However, as long as that composite state is entangled, the 
information which Alice and Bob share, is only created when they measure their 
qubits. To access information created this way, Eve would have to measure one of 
the qubits and we are back in the first type of attack discussed above. Eve can only 
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avoid falling back into this line of attack if she prepares the original composite state 
as a separable state, which we denote by |ф› & y). This way, she knows for each 
pair in which state the respective qubits of Alice and Bob are in. 

Hence, in both possible types of eavesdropping attacks that Eve can attempt, the 
composite system will be in a separable state |p & y) before Alice and Bob perform 
their measurements. From Proposition 4.8 we know, however, that then 


(zs OE) oy (20025) gay t (20 OIR) oy T PME 


poy 

(6.10) 
holds. This can be used by Alice and Bob to detect eavesdropping as follows. As 
they communicate the directions of their measurements to each other, they can deter- 
mine the set of qubits where they have measured in different directions. For those 
they also announce the results of the measurements to each other. With these results 
ins where X € {A,B} and i € {1,...,4}, they calculate the empirical expectation 


values ЖАУ, according to (4.42). From Sect. 4.52 they know that in the state |^ ) 
for the directions fi! with i € {1,...,4} given in (4.38) with (4.40) then 


(z4 oI) — (z4 оха) + (5 TAM + (5 oz) | = 2/2 
(6.11) 
has to hold. But they will only find this outcome (6.11) if the original composite 
state and their qubits have not been tampered with. In case eavesdropping has been 
attempted, they would find (6.10) instead. Consequently, Alice and Bob can con- 
clude if eavesdropping has occurred as follows: 


If Р Уй, = ХА EL + ХА ХВ, + ХА ХВ, 5 2/2. = exchange is secure, 


eavesdropping 


« 2 
B has occurred. 


if Ba Se з БУЕ: БУ ee 


In the former case they use the bit-sequence from the set of qubit-pairs where they 
happened to have measured in the same direction as a secret random bit-sequence 
for a VERNAM cipher (see Example 6.4). In the latter case they have to repeat the 
exchange, possibly within a new set-up, or abandon the key distribution. 


6.4.4 RSA Public Key Distribution 


Before we turn to SHOR's prime factorization algorithm, let us have a closer look 
at the widespread cipher devised by RIVEST, SHAMIR and ADLEMAN (RSA) [78, 
79] using a combination of private and public keys. As we shall see and mentioned 
before, the security of this protocol depends crucially on the fact that hitherto it 
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is too time-consuming to determine the prime factors p and q of a publicly known 
large number? N = pq. It allows one party (the Receiver) to publish a part Криь Of the 
key k = (Ану, kpup) with which anybody who wants to send an encrypted message 
(the Sender(s)) can encrypt his plaintext message, and only the receiver can decrypt 
the messages. Despite the public knowing one part of the key only, the Receiver is 
able to decrypt the ciphertext. 

As outlined after Definition 6.3, we assume that the plaintext m is an integer 
satisfying 

пм—1 | 
т= у 5327 € (0,..., Nu) C No, 
j=0 


where пм is the bit-length of messages in М and Мм = 2"M — 1. The RSA protocol 
then runs essentially as follows: 

The Receiver 

e picks two primes р Æ q with p,q > №, 

e finds an a € N with the property 


gcd(a,(p— 1)(g—1)) 21 (6.12) 


e calculates 

N:—pqcN 
e publishes the public key kpub = (a, N). 
Any Sender 


e encrypts his plaintext m < Nm < N by calculating 
e(kpup, m) := m^ mod N (6.13) 


e and sends the ciphertext с = e(kpub, m) on public channels to the Receiver. 
The Receiver 


e finds a b € N such that 
abmod(p —1)(q—1) 21 (6.14) 


(we will show in Lemma 6.5 below, that given (6.12) one can always find such a 
b) 

e takes Крну = (b, N) as the private key 

e and decrypts the ciphertext c by calculating 


5Numbers which are the products of only two primes are also called half-primes. 
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d(kyiv,c) := с? mod N. (6.15) 
In Theorem 6.6 we will show that then indeed 
4(Кызу›е(Крь,т)) = m. 


Hence, anyone who knows the public key kpub can encrypt a plaintext m by means 
of (6.13), but only a person who knows a b satisfying (6.14) can decrypt the message 
by applying (6.15). To find a b satisfying (6.14) requires the knowledge of p and q. 
Certainly, the Receiver has this knowledge and can decrypt. But so does anyone 
who can find p and q from the knowledge of N — pq, that is, who can factorize N. 
Consequently, the security of the protocol depends crucially on factorization being 
so hard that it takes an amount of resources (such as time and/or computing power) 
normally not available. 

With the help of some results from modular arithmetic, we show in Theorem 6.6 
below that the decryption map (6.15) indeed reproduces the original plaintext m if 
the ciphertext is used as an input. Before we prove this, however, we first show 
that (6.12) guarantees that (6.14) has a solution b € N. 


Lemma 6.5 Let a € N and p and q be two primes such that 
gcd(a, (p — 1)(q —1)) = 1. (6.16) 
Then there exists a b € N that satisfies 


abmod(p —l)(q—1)- 1. (6.17) 


Proof Applying (D.12) in Theorem D.4 to a and (p — 1)(q — 1) and (6.16) yields 
the existence of x, y € Z with 


ax+(p—1)(q-l)y=1, (6.18) 


which implies 
ax = 1—(p—1)(q—-I)y 


and 


РЕ = IEEE J =—у. 


From this it follows that there exists an x € Z satisfying 


a- | mom | (pa) = 17997 06-127 C97 0-021 
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and thus 
axmod(p—1)(q—1)=1. 


If x > 0, we set b = x, if x < 0 (x = 0 is excluded due to (6.18)), we choose an / € N 
such that x+/(p—1)(q—1) > Oand set b = x+ I(p — 1)(q— 1). In either case then 


abmod(p—1)(g—1) 21 


and we have shown that the assumption (6.16) guarantees the existence of a solution 
b in (6.17). 


By construction, we have N = pq and e(kpyp,m) = m^ mod N so that the decryp- 
tion of the ciphertext с = e(kpub; m) is given as 


d (Кызу, е(Крь,т)) = (m^ mod pq)” mod pq. 
With the result (D.22) of Exercise D.120, this becomes 
d (kpriv, e(kpub; m)) = т mod p4. 


Hence, to verify that the decryption (6.15) transforms a ciphertext с = e(kyup, m) 
into the original plaintext т, it remains to show that for a b that satisfies (6.14) then 


m mod pq = т, (6.19) 


holds. This is shown in the following theorem, which makes use of results from 
Appendix D. 


Theorem 6.6 Let p and q be two different primes and let m € N with m « 
min(q, p}. Moreover, let a,b € N be such that 


abmod(p —l)(q—1)- 1. 


Then we have 
m^" mod pq = т. 


Proof To begin with, we note that because of abmod (p — 1)(g — 1) = 1, there exists 
ak € N such that ab = 1 -- k(p — 1)(g — 1) and thus 


m — mm P-D) = m СА = С | (6.20) 
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Because т < min(q, p}, the prime factorization of m consists of primes that are 
smaller than q and p. The same holds for т!) and т), which then cannot 


have a common divisor with q or p. From Corollary D.19 it then follows that 


(mien) modq = 1 = (mio? mod p, 


and there exist r,s € Z with 1 + rq = m*(e—!)(@-!) = 1 + sp. This implies 


dnseZ: rq=sp. 
The prime factorization of rq thus contains p, that is, there is an / € Z with 
rq = lpq 
and thus m*-U(a-) = 1 + rq = 1-- 1рд from which it follows that 
m - (4-1) mod pq — 1. 
Together with (6.20), this implies 


m^? mod pg . = mm? -U(4-U mod pq 


m(m" ^ - 109—0) mod pq) mod pq 
i—i 


where the last equation is a consequence of m < min{ p,q}. 


(6.21) 


As shown in the discussion preceding (6.19), the statement in Theorem 6.6 
assures that the decryption of an encrypted plaintext does indeed reproduce the 


plaintext. 
As mentioned before, the security of RSA depends on it being very 


time- 


consuming to find the prime factors p and q of a sufficiently large number N = pq. 
In order to verify this, RSA Laboratories, which is nowadays a part of the EMC 
Corporation, posed a public challenge back in 1991 and offered a reward for the 
factorization of half-primes, which are defined as the product of two primes [80]. 
One of these was the number RSA-768 with 232 decimals, which was successfully 


factorized in 2009 [81, 82]: 


RSA-768 = 12301866845301177551304949583849627207728535695 
95334792197322452151726400507263657518745202199 
78646938995647494277406384592519255732630345373 
15482685079170261221429134616704292143116022212 
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4047927473779408066535 1419597459856902 143413 

= 33478071698956898786044 1698482 126908 17704794983 
7137685689 1243 13889828837938780022876 1471165253 
17430877378 14467999489 

x 36746043666799590428244633799627952632279 158164 
3430876426760322838 157396665 1 127923337341714339 
68 10270092798736308917. 


The method used in this instance, which is believed to be currently the best classi- 
cal method to factorize an arbitrary but very large number N € N, is the (General) 
Number Field Sieve (NFS) [83]. A heuristic estimate of the growth rate of the com- 
putational steps Swrs (N) required in this method yields for N — œ% [84, 85] 


Susi) € o sno [(%у +оп)) (iss) (ossis). 


where we have used the LANDAU symbols defined in Definition C.1. 

This factorization of RSA-768 required, even with at times several hundred com- 
puters, almost three years in real time. With a single 2.2 GHz 2 GB RAM Opteron 
processor it is estimated to take around 2000 CPU-years [81]. Typically banks use 
numbers N with around 250 decimals for their implementations of RSA. Breaking 
it with a single PC would in general take more than 1500 years, which is why it is 
considered secure. 

As we shall show below in Sect. 6.5, however, SHOR in 1994 devised a quantum 
algorithm that would allow the factorization of a large number N in a number of 
computational steps which only grows polynomially in log, N. If this algorithm can 
be implemented, RSA will become insecure. 

Hence, quantum mechanics on the one hand provides tools to break existing 
ciphers. On the other hand, as we have shown in Sects. 6.4.2 and 6.4.3, it also pro- 
vides methods to exchange keys in such a fashion that undetected eavesdropping is 
impossible without violating the laws of (quantum) nature. 


6.5 SHOR Factorization Algorithm 


6.5.1 Generalities 


In 1994 SHOR [19] showed that an algorithm using a quantum computer could factor 
a number N that has at least two distinct prime factors in a number of computational 
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steps which grow only polynomially with the input length? log, N. More precisely, 
the number of computational steps Ssyor(N) in SHOR's algorithm to factorize N 
satisfies 

Ssuor(N) € O((log; N)? log, log, N) ^ for N — ee. (6.22) 


The factorization of a number of the order of 10199? with a quantum computer would 
thus require a number of steps of the order of 10?. 
SHOR’s algorithm rests on the facts 


e that the factorization of a number N is equivalent to finding the period (see Defi- 
nition 6.7) of a given function and 
e that finding this period can be accelerated with the help of a quantum algorithm. 


In the following Sect. 6.5.2 we thus show first how the factorization is accomplished 
by finding the period, provided certain conditions are satisfied. This re-formulation 
of the factorization as period-finding problem is based purely on known results 
from number theory and does not make use of any quantum mechanical process or 
property. 

In Sect. 6.5.4 we present the proper quantum algorithm, which substantially 
accelerates the finding of the period with the help of quantum mechanical phenom- 
ena. The additional properties of the period required for the factorization to suc- 
ceed are not guaranteed, however, and they only occur with a probability bounded 
from below for which we need to establish the lower bound. This also implies that 
the function may have to be changed and the quantum algorithm may have to be 
repeated sufficiently often. SHOR’s algorithm is thus a probabilistic method and the 
claim (6.22) about the asymptotic efficiency of the algorithm contains the estimated 
number of repetitions to assure a success-probability close to 1. 

However, only if N contains at least two distinct prime factors, can we estab- 
lish adequate bounds on the relevant probabilities so that we can attain a success- 
probability (of finding any of these prime factors) sufficiently larger than 0. In other 
words, if N is the power of a prime N = p"? with v, € N, and, in particular, if 
it is just a prime number N — p, then the SHOR algorithm cannot deliver with a 
sufficiently large enough probability the prime factor p or the statement that N is 
prime. 

Moreover, we can determine with at most log, N divisions by 2 whether N con- 
tains a prime power 2” of 2, where v2 Є N. Divisors of N of this type can thus be 
found efficiently in no more than log; N computational steps. Hence, we assume 
that a search for divisors of N of the form 2? with v; Є N has been performed and 
any such divisors have been divided out, that is, we assume N to be odd. 

Consequently, the claim (6.22) about the efficiency of the SHOR algorithm thus 
only holds for odd N € N with at least two distinct prime factors. 


Since log, N is indicative of the digits in the binary representation of N it is called input length or 
just length of the number N. 


6.5 SHOR Factorization Algorithm 273 


6.5.2 The Algorithm 


Let N € N be an odd number with at least two distinct prime factors. Our goal is to 
find a divisor of N. To begin with, we select a natural number b « N and apply the 
EUCLID algorithm presented in Theorem D.4 to find out if N and b have common 
divisors. As we can see from Theorem D.4, it is possible to do this in maximally 5 
computational steps. If indeed we happen to find common divisors of N and b « N, 
then the task to find a divisor of N is completed, and we are done. Otherwise, we 
move on to the next step and determine the period r of the function 


fo : No — No 


п — fo n(n) := b" mod N, (6.23) 


where the period of a function f : No — No is defined as follows. 


Definition 6.7 The period r of a function f : No — No is defined as 


r :— min(m € N| f(n--m) = f(n) Vane No). 


For the function fp defined in (6.23) the period coincides with the order of b 
modulo N as defined in Definition D.20. 


Exercise 6.69 Let b, N € N with b < N and gcd(b, N) = 1. Furthermore, let r be the 
period of the function fp y defined in (6.23). Show that then 


r=ordy(b) . 


For a solution see Solution 6.69 


Furthermore, it follows from EULER's Theorem D.17 that in the case of gcd(N, b) = 
1 functions as in (6.23) always have a finite period since r < @(N) < ee holds. 
With the help of the quantum algorithm of SHOR, which we will describe in 
more detail below, we can determine this period in a number of computational steps, 
which for N — œ grows asymptotically as O((log; N үш: If the period is odd, we 
choose a different b with gcd(b, N) = 1 and again determine the period of f; y. This 
is repeated until a b is found such that f, y has an even period r € N. How probable 
it is to find such a b that gives an even period will be determined in Theorem 6.11. 
Suppose then r is an even period of fp y. According to the result of Exercise 6.69, 
we then have r = ordy (b), which, because of Definition D.20, leads to Р” mod N = 1. 
Using 1 mod N = 1 and (D.2), this is equivalent to (b^ — 1) mod N = 0 and thus 
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(2 + 1)(b? — 1) тойм = 0. (6.24) 


From (6.24) and Lemma D.11 we conclude that N and Ь2 +1 or b? — 1 have com- 
mon divisors. Hence, we can again apply EUCLID’s algorithm to N and bi +1 ог 
b? — | and thus obtain a factor of N. Without further restrictions, however, this factor 
may be the trivial factor N itself. In (6.24) we can exclude the case 


(b? — 1) modN — 0 


as a possible solution, since this would imply b3 mod N — 1 and thus 5 would be a 
period of fp y, which contradicts the assumption that r as the period is the smallest 
such number. If, however, (6.24) holds because 


(b? 4- 1) тойм = 0, 
then it follows that № | Б? + 1 and 
gcd(b? + 1),N) =N, 


that is, the greatest common divisor of b? +1 and N yields the trivial factor N. We 
obtain a non-trivial factor of N as a consequence of (6.24) only in case we have 
chosen b € N with b < N so that the event 


ер := [tr even| and [(Ь? +1) mod N # o] } (6.25) 


has occurred. In this case it follows from (6.24) that N divides the product (b3 + 
1)(b2 — 1) but none of the factors (03 + +1). Consequently, N must have non-trivial 
common divisors with every factor (b? + 1). 
In order to determine a non-trivial factor for an odd N € N that is not a prime 
power, we can thus execute the following algorithm. 


SHOR Factorization Algorithm 


Input: An odd natural number N that has at least two distinct prime factors 
Step 1: Choose b € N with b < N and determine gcd(b, N). 
If 


ged(b,N) > 1, then  ged(b, №) is a non-trivial factor of № and 
we are done. Go b Output and show 
gcd(b, №) and ZA) Nj 

gcd(b,N) =1,then goto Step 2 


Step 2: Determine the period r of the function 


fon : No — № 
n — fo n(n) := b" mod N. 
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If 


ris odd, then start anew with Step 1 
ris even, then go to Step 3 


Step 3: Determine gcd(5? + 1, N). 
If 


gcd(b? +1,N) = №, then start anew with Step І 
b2+1,N)<N, then with gcd(b2 + 1, N) we have found a non- 
trivial factor of N. Calculate gcd(b? — 
1, N) as a further factor of N. Go to Out- 
put and show gcd(b? + 1, N) 


Output: Two non-trivial factors of N 


In the following sections we will present the details of the algorithm and, in par- 
ticular, the computational effort required, that is, the growth rate of computational 
steps necessary to carry out the algorithm as N — оо, 

In Sect. 6.5.3 we exhibit the effort for Step 1 to check if Р and N are coprime, in 
other words, have no common divisor. 

As SHOR [19] has shown, the determination of the period of the function fp y 
in Step 2 can be accomplished with the help of quantum mechanics in a number of 
steps that grows significantly slower for N — oe as hitherto known classical methods. 
We will present this quantum mechanical method and its associated computational 
effort in Sect. 6.5.4. 

In Sect. 6.5.5 we show that for numbers with more than one prime factor the 
probability to find a b so that the event е, which is defined in (6.25) and which 15 
necessary for the algorithm to succeed, occurs, quickly approaches 1 with increasing 
number of searches. 

Finally, in Sect. 6.5.6 we aggregate the computational effort of all steps in the 
algorithm to arrive at the claim (6.22) about the efficiency of the SHOR algorithm. 


6.5.3 Step 1: Selection of b and Calculation of gcd(b, N) 


For a given N we select a natural number b less than N. In order to calculate 
gcd(b, N), we can apply the EUCLID algorithm described in Theorem D.4. We estab- 
lished bounds on the growth of the number of computational steps required for this 
algorithm as N — «e in (D.19). Hence, one has for the number of computational 
steps Ssuog1(N) in Step 1 that 


Ssnorı (N) € O((log; N)*) for № — оо, 
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6.5.4 Step 2: Determining the Period with a Quantum 
Computer 


From Sect. 6.5.2 we know already that we can determine a factor of N if we man- 
age to find a suitable b and the period r of the function f, y(n) = b" mod N such 
that b and N are coprime, f; has an even period r and that (b3 +1)modN 40 
holds. As we show below in Theorem 6.8, Step 2 in SHOR’s algorithm delivers the 
period r of a function f : No — No with a probability of at least log: (log; N]* and the 
number of computational steps Ssyor2(N) in a quantum computer required for the 
determination of the period grows at most with (log, Л)? for N — оо, that is, 


Ssuor2(N) € O((log,N)*) for N > e. (6.26) 


The claim about the efficiency of Step 2 to find the period of a function f : No — No 
can be formulated in a slightly more general way (than in our special case f = fp м) 
for periodic functions f that satisfy the following conditions: 


1. The function f can be implemented as a unitary transformation у on a suitable 
HILBERT space so that the growth in the number of computational steps SU, 
required to execute Uy is suitably bounded. 

2. An upper bound of the period r in the form 


r« 23 (6.27) 


exists, where L € N is known. 
3. The function is injective within a period. 


Regarding condition 1, we will show in Proposition 6.12 that for f = fp, indeed 
Su, € O((log; N)?) holds. For our purposes, that is, for f = fy v with fy (n) = 
b" mod N and gcd(b, №) = 1, condition 2 is satisfied since we know already that 
r < N. Hence, we choose L such that N? < 22 < 2N? by setting L = |2109, N | +1. 
With the help of the result from Exercise 6.69 and the Definition D.20 of the order, 
we can also verify that condition 3 is satisfied in our case. 

The slightly generalized statement about the efficiency of Step 2 in SHOR’s algo- 
rithm to find the period of a function can be formulated as follows. 


Theorem 6.8 Let r,L € N with 19 € r < 25 and let r be the period of a 
function f : No — No that is injective within one period and bounded by 2*. 
Furthermore, let Оу be a unitary transformation that implements f as follows 


Ur: He @ HOEK — He @ Hex 


Ix) @|y) — |x) eB f(») (6.28) 
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(where ЁН is defined in Definition 5.31) and requires a number of computa- 
tional steps Sy,(L), which satisfies: 


Su,(L) €O(L*/) ог e 


for a Ку €N. Then there exists a quantum mechanical algorithm A with which 
we can find the period r with a probability of at least iih т. The number of 
computational steps of this algorithm SA(L) satisfies 


SUD) О( 0) for L — о. (6.29) 


In the case f = fp y of interest to us we have L = |21og5 N | + 1 and, as we show 
in Proposition 6.12, we have Ку = 3. Consequently, (6.26) follows from (6.29). 


Proof 'To make things more digestible, we partition the presentation of the algorithm 
and the proof of Theorem 6.8 in the following paragraphs: 


. Preparation of the input register and the initial state 

. Exploiting massive quantum parallelism 

. Application of the quantum FOURIER transform 

. Probability in measurement of the input register 

. Probability to find r as the denominator in the continued fraction approximation 
. Aggregation of the number of computational steps 


QN щл UC цо ке 


In what follows, we consider each of these items in more detail. 

1. Preparation of the input register and the initial state 

Let M := max { f(x) | x € (0,...,2^ — 1)) and K € N with M < 2F and let Н be 
the usual qubit HILBERT space with basis (|0), |1) $. With these we build the input 


register 
HP =H", 


Analogously, we build 
H? := We | 


As the initial state, we define the state |V6) in the product space НА c» IH? 


|'%) := |0)4 ® |0)” = |0) &--- 80) 80) &---&J0). (6.30) 
—— iS 
L—times K—times 


We then apply the L-fold tensor product of the HADAMARD transform (see Defini- 
tion 2.38) to the part of the initial state |¥%) in H^ to obtain 
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|.) = Н® ®15|Чу) Y |х)^ & |0)?. (6.31) 


This transformation of |V6) to |) can be performed in a number of computa- 
tional steps (consisting of the respective application of the HADAMARD transform 
Н) proportional to L. Hence, as a function of L, the number of computational steps 
in the preparation Sprep(L) satisfies 


Sprep(L) € O(L) for L — оо, (6.32) 
2. Exploiting massive quantum parallelism 


By assumption, there exists a unitary transformation у on H^ QH” that implements 
the function f in the form 


Us (10 ®|у)5) = I^ e y f)? 


(6.28) (5.81) Joke] 


where the number of computational steps required Sy y (L) satisfies: 
Su, (L) e o(L*) for L — ee. (6.34) 


As we shall show in Proposition 6.12, these assumptions are indeed satisfied for 
f(x) = b* modN with Ку = 3. 
Application of Оу to |) yields 


2L—| 


Y W Y^ @|f(x))®. (6.35) 


= 


1 2! 1 

|5) = Us|) = Uy е Y |) 90)? |. = c 

2 x=0 
(6.31) (6. 


In this step we exploit the massive quantum parallelism that makes use of the 
quantum mechanical superposition in order to generate, by a a single application 
of Оу on a state |\Р\), іп one go a superposition of all 2" states of the form |x)“ & 
|f (x))7. As already discussed in Sect. 5.4.2, this is often viewed as a simultaneous 
evaluation of the function f on the domain (0,...,2- — 1}. But we cannot simply 
read off the values f(x) from |W5) in (6.35) in order to determine the period. Instead, 
we will apply the quantum FOURIER transform to |) and exploit the periodicity 
of f to accomplish this. Before we do this, we use the periodicity of f to re-write 
|95) in a form that will make the subsequent steps more transparent. For this we use 
L and the period r of f to define 


6.5 SHOR Factorization Algorithm 279 


L 
у= Ё =| (6.36) 
" 
R := (2- — 1) modr. (6.37) 
Then we have 
|) = 
аю e qu ee dr @ 10-0)" 
+ |г)^ e |f(r))? Eos i |2r— p^ ® |f(2r — 1))8 
em dus LU 
=|/(0))8 =|f(r-1)) 


+ [9-7 Dr @ (D + + r= 1^ @ [für- D? 
S| SS 


=|f(0))8 -|f(r-1))8 
+ [rn^ e |00) e |76 RY ® |f(Jr-- R))? 
—— — 
=|/(0))5 =|7(6))8 
1 
= ни & | f(k) PAS rii &|f(k "|. 
22 | j=0k=0 = 
Furthermore, defining for k € No 
J ifk<R 
к= е ifk>R, (6.38) 
allows us to write Р 
—1 Jk 
P) = qÈ и ®|/(®))5. (6.39) 
22 k=0j= 


3. Application of the quantum FOURIER transform 


We now apply the quantum FOURIER transform defined in Definition 5.48 to the 
input register НА 


F:H^ — НА 


г „ху 
|x) — Fix) = p ехр (2715) ly). 


(6.40) 
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This transforms |V5) € H^ @ HB to the state 


|95) := (F@1*) |9) 


r-1 Jk 
= (8918) (4 УУ иеш) 


22 200 
1 r-1 Jk A B 
mon У, Ў, (Ег +Ю^) 9170) 
(6.39) 22 К=0/=0 


1 r-1 Jy 24-1 


Кы РР». (ani ur) DSI). (6.41) 


(640) ^ k-0j—0 I-0 


As to the number of computational steps Srourir(L) required for the quantum 
FOURIER transform, we know from Corollary 5.57 that 


Srourier(L) € O(L?) г ce. (6.42) 
4. Probability in measurement of the input register 


In the next step we observe the input register НА (see Definition 5.35) ignoring the 
system Н”. Through this measurement we project the superposition of the states 
іп |35) onto a computational basis state |с) € НА, which we can determine as the 
result of the measurement. The composite system is in the pure state |Ч%), which, 
expressed as a density operator, is given by py, = |^) (Ҹ |. When observing the 
system H4 alone that system is then in the state given by the partial trace 

(I5) (Ф|). (6.43) 


p^ (Py) =” 


(3.50) 


We denote probability to observe the state |2) in НИ for a given z € (0,...,2^ — 1) 
when measuring |Ҹ) by 


W(z) := P {State |z) detected after measurement of input register } 


It is given by the probability to observe the value 1 when measuring the observable 
|z) (z| in the state р^ (ру), that is, 


W(z) et (tr? (85) (95) | (zl) 


St (p^ (pus) |o) (zl) = т 
(2.86) (6.43) 


tr (195) (8| (12) (z] 8 17)) . лч) 
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Exercise 6.70 Show that 


tr (18) (41 (z) (4 @ 12) = || (Iz) (д @ 15) [¥4) ||. (6.45) 


For a solution see Solution 6.70 


Using (6.45) in (6.44), we obtain 


wo = |I(\z) (zl @14) 14) ||? | 


i Ж ау А еВ 
1 У. У exp (2niZ-(Jr+b)) lt ej) 
к=0]=0 


| teh Uh). z Ap, AA B B 
= dk У X ex(2mi$( ji)r+ А) 9" EEDI) 
ky ,k2=0 j1,j2—0 RP 5 
(6.41) =] =б ky since 0<k;<r 
1 т=1| Jk er : 
= zr У, |У exp (22192) 
k=0| j=0 


Here the injectivity of f within a period has been used to conclude (f(k1)|f(k2)) = 
бек. Using that for a € С one has 


D+1 ifa-l 


> Jj 
a . 4D4H 
-f l = е]ве, 
= 


we obtain 
n Р Jk+1 if ЭГ € № 
у ехр (ai) = 4 1 exp(2ni Uk") ) dies 
j=0 I-exp(2ni3r.) 
and thus 
Wi(z) := эт XL o Uk +1)? Ec € No 
2 
W(z) = 1—-exp(2ni?r Ж (Jk+1) (6.46) 
№ (2) := or Уло | ( | ) else. 
—exp mg) 


For the next step in the factorization algorithm it is necessary that the measurement 
of the input register resulted in finding a z for which there exists an / € No such that 


|z — 24 < ; (6.47) 
holds. Condition (6.47) is essential in order to exploit a property of continued frac- 


tion approximations, which is used in the last step to determine r and which we 
present in the next section. 
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The objective of the following considerations is to find a suitable lower bound for 
W (z) for a z that satisfies (6.47). From such a lower bound we can then determine 
how often we may have to repeat starting again with the preparation of the input 
register until we measure a z that satisfies (6.47). 

In order to determine the lower bound, we first consider the case ar € No for 


which (6.47) obviously holds. If, in addition 2 € N holds, we obtain the following 
result. 


Exercise 6.71 Show that if 2^ =: m € N, then 


vo-1i ifi EN 


0 else. 


For a solution see Solution 6.71 


Now we consider the case ЛГ € No (but not necessarily 2 € N). With the defini- 
tion (6.38) of the Jg, one obtains 


IV 
opm 
mms 
N 
| ~ 
—— 
N 
4 
ES 
as 
——] 
— 
N 


Note that 


r—1> (22-1) modr = (22 — 1) — E r 


r 


implies that 


(6.48) 


2L—1 1+ (24 — 1) mod 1 
“Кы жы шы 
Ж | r 2 2 m 


where we used кешип, (9 27) їп the last inequality. From (6.46), (6.48) and (6.48) 
we thus have for the case jr € Z that 
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Lastly, we look for a similar estimate in the case that (6.47) holds, but at the same 
time at € N. Given such a z, we know already from (6.46) that 


1 o 1 — exp (27127 (1) 
mn 1—ехр (2л) 


1 "1 1—ехр (21125 2 {2° бей) 


22L em 1—ехр (2л) 
2 
Dou sin (л: = x (y -- 1) 
e sin (n5) 
1 r-1 à 
= у s(a)*, (6.49) 
k=0 
where Е 
= sin (ал) 
sin (a) 
JE (6.50) 
=л 
2L 
Jg := J+ 1 
and о and J; satisfy 
л лг TL л л 
= -pR < —- 22935-1 = 6.51 
a= 3g (07—12) 5 225-52 sao e 
(6.47) (6.27) 
2L —1 2L —1 2^ 
І = љ+1 < J+1 = | Jets TE 
— м r r r 
(6.38) (6.36) 
as well as : 
mr (2 T 1 
«| < —-t1] < 501+ |. 6.52 
| | z asil) 692 


To obtain a lower bound for the probability W2, we determine a lower bound of ће 
function s(œ) defined in (6.50) for a suitable interval of a. 


Exercise 6.72 Show that for |o| < Omin with Onin = abet and s(-) as defined 
in (6.50) one has 


s(a)? > s(Qmin)* - 
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For a solution see Solution 6.72 


From Exercise 6.72 it follows that 
с sin? (ae 1) 
i sin? (#4 ) 


and because of sin? x « x? thus also 


sa (2) e (zz e 1) ; 


s(a 


nr 


The definitions (6.36), (6.37) and (6.38) of J, А and Л, imply 


[EDO xai 
r | 22-1 К 
= 2L | r | < эт. (Jk + 1) 
— —— 
=1—К+1 
2L 
> 1-22 sal) 
=> l— gr < ar (J-F 1); 
such that dpud 
2 л r 
s(o)^ > 7; Sin (а z) 


Moreover, one has 
= (-1)/ 2] 1 2 
sin(=(1+x)) = cos (22) = ( ) (=) >1-5(2) 
2 2 = (2j)! \ 2 2X2 


and thus 


s(a)? > 221+2 , e 2 ЭЖ А (7 а), 
= gp 20221 — m 22L 
221+2. xl 2 22L42 л2 
> 1 T. = >a7 |1-ap ‚ 
т?2 25% TEE 0112 


where in the last inequality, we used that according to the assumption (6.27) r < 25 
holds. With (6.49) we thus obtain 
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1 r-1 221+2 л? r 221+2 л? 
wz) > — У, 1 = 1 
22L = л?т? 21+2 221 7272 21+2 


4 л? 
лїг\! maj: 


For L > 4 the lower bound for the probability to observe а z in the input register 


that satisfies (6.47) is 4 (1 = Fr). This is because, if L > 4, it follows from 


m 2112 


= < 1 < 3 <1 4, that s E <1 E and thus 
204 л? 1 
Wmin :— zm 1— 5715 < W»(z) < Wi (z) < 7 (6.53) 
For each z € (0,...,2- — 1} there exists either none or exactly one / € No that satis- 


fies (6.47). This is because for [ Z h the distance between / 12. and [522 is at least 
2L > r, but they cannot be further apart than r if they are to satisfy (6.47) for the 
same z. This is illustrated graphically in Fig. 6.3. There we also see that there are 
exactly r such / € No (namely / € {0,1,2,...,r—1}) sothataz € (0,1,2,...,2^— 1) 
with the property |с" i2 < 5 can be found. 

A measurement of the input register thus results in a z € {0,...,22 — 1) for which 
there is 


e either no / € No such that (6.47) is satisfied or 
e exactly one l € (0,...,r— 1} such that (6.47) holds. 


Let І, denote the element of (0,...,r — 1} uniquely defined by z € (0,...,2^ — 1} 
such that (6.47) holds. It then follows from the assumption (6.27) that 


1 


T (6.54) 


We see from Fig. 6.3 that for any j € (0,...,r — 1} there is exactly one z € 
(0,...,2- — 1) such that |zr — j2"| < 5, that is, such that j = l}. Hence, the prob- 
ability that for a given j € (0,...,r— 1} az exists such that /, = j is equal to the 


zr I | I I і eee | | | 
0 oY 
pr | | E | 

1x 2° 2% 2" (r—1) х 22 


Fig. 6.3 Unique assignment of z € {0,1,...,22 — 1) to € N so that ler — 124| < 5 holds. By 


Я 1, 
assumption, we have r « 22. We see that, for example, for z = 1, no / can be found such that 
zr — 121 < 5, whereas for z = 2 exactly опе /, = 1 exists that satisfies this condition 
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probability that (6.47) can be satisfied. This latter probability is bounded from below 
by Wnin such that we have for all j € (0,...,r— 1} 


4 л? 
= L . = d 
5. Probability to find r as the denominator in the continued fraction approximation 


In (6.54) the value of z as the result of the measurement of the input register and the 
value of 22 used in the construction of the register are known and r is to be deter- 
mined. In order to achieve this, we shall use results from the theory of continued 
fractions, which are presented in detail in Appendix E. More precisely, we apply the 
claim in Theorem E.9 to (6.54), which states that te has to be a partial continued 
fraction of 5. 


From Theorem E.4 we know that the defining sequence (а;) for the contin- 


_ JENo 
ued fraction of 1 is finite, that is 
Z 1 
= арз = |ао;а\,...,@һ}. 6.56 
2L 0 71 ms 1 | 0-41; Й n] ( ) 


an 


Since we know z and 22, we can efficiently compute the elements a j of the defining 
sequence with the continued fraction algorithm presented in Appendix E as follows. 
Define r.., :— z and rọ :— 2” and for j € Nas long as rj. > 0 define 


rj :—rj-2 mod rj-1- 


From (E.5) and (E.13) we infer that then the a; for j € {1,...,n} are given by 


Fic 

aj = | | s 
r; 
J 


According to (D.4), the number of computational steps required for this calculation 
is of the order O((log; max(rj 5. rj-1))?). Since r_1,ro < 2” and ће гу decrease 
with increasing j, the number of computational steps required to compute one rj is 
of the order O(L’). The number of r;, which we have to compute, growths, accord- 
ing to Corollary E.5, as a function of L as 2min{log, 22,1082} +1 < 21+ 1. The 
number of computational steps required to compute all r; is thus of the order O(L?). 
For the calculation of all a; we have to perform O(L) divisions, each of which 
requires O(L) steps. Hence, the a; can be calculated in O(L’) steps, given the r; 
have been computed before. 
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With the help of the a; the partial continued fractions of 7 


Pj 1 Ў 
— := а) for j Є (0,...,n 
qj ai + — t } 


E + A. 

ај 
сап be calculated. For this we have to carry out O(L) divisions, each of which 
requires O(L) computational steps. We denote the set of the partial continued frac- 


tions by 
2 Pij. 
т(5) = C etos. 


Given the а}, the computation of all elements in T (X т) thus requires a number of 
steps of the order 0(12). Altogether, the growth of the number of computational 
steps needed to calculate the partial continued fractions Spart-cr(L) as a function of 
L is of the order 

Spat-cr(L) Є O(L?) for L>. (6.57) 


According to Theorem E.9, one of these partial continued fractions satisfies 
2 = 2. (6.58) 


We now try to use this and our knowledge of every 22 eT (= т) to find r. Because 


of (E.23) in Corollary E.8, the p; and q; in the left side. of (6.58) satisfy gcd(qj, pj) = 
1. We then check for all 2 "m ;€ T (X ) if qj is a period of f. For this we successively 
compute f (q;) for all n c T (X). 

If we find /(4;) = 1 for a qj, then q; = vr has to hold for a v € N, and (6.58) 
implies p; = vl. Because of gcd(q;, pj) = 1, it follows that v = 1 and q; = ғ, yield- 
ing the period we have been after all along. 

If, instead, we find f (gj) Z 1 for every m ET (X). we have either found a z in 

И Ј 
our measurement of the input register that does not satisfy (6.54) for any | € No or 


such an /; that 
gcd(/,,r) > 1. 


In the case f(q;j) 4 1 we thus have to start anew with the initial state | Чу) in (6.30), 
measure again the input register to find a new z, determine the partial continued 
fractions of 25 ‚апа check if now one of the new qj; is the period of f. The necessity 
for this repetition increases with the probability that gcd(/,,r) > 1 for all possible 
I, € (0,...,r— 1}. The event 
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To measure a z € (0,1,...,2- — 1} in the 
input register such that there exists l; € No 


with 


e2 :— 


=k 
= 


at < 57 and gced(/,,r) = 1 

thus guarantees that r can be found from a partial continued fraction 2 ЄТ (X). 
J 

Using that, according to its definition (D.29), the EULER function @ gives the num- 

ber $(r) of numbers Г € (0,...,r — 1} with the property gcd(/, r) = 1, we can esti- 

mate a lower bound for the probability of this event as follows. 


Pío) = У Pfaze {0,...,2*-1}: =H 
I€(0....r-1) 
gcd(/,r)-1 
> 4 EINE 
VT 1€{0,...r-1} л?т ante 
(99) gcd(I,r)=1 
- a (a) E, 
2 2 
т. 21+ I€(0.....r-1) 
gcd(/,r)=1 
—„— 
=¢(r) 
g(r) 4 л? 
nisi Ыш! (6.59) 
In (6.59) we find separate lower bounds for the terms ? and s (1 d). 


In order to estimate * we use the following theorem by ROSSER and SCHOEN- 


r 


FELD [86], which we quote without proof. 


Theorem 6.9 For r > 3 the following inequality holds 


r 2.50637 
—— < exp(y)InInr-- ———— 
ó(r) 


where y :— 0.5772156649... denotes EULER's constant. 


, 


InInr 


In 


2.50637 2.50637 
InInr, 
(InIn 7)? 


=h(r) 
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the function (у) is a decreasing function of r. For r > 19 we have already h(r) < 4 
and thus for r > 19 
У 


é(r) 


< g(r) < 4lnlnr. 


The period r we are looking for satisfies r < 22 by assumption. Hence, we have for 
r 19 


—— « g(r) < 41122 <4InL, (6.60) 
ф(г) 
which implies for r > 19 that 
$(r. 1 
r ^ 4L 


In order to estimate á (1 — >) in (6.59) note that á > 2 and for L > 15 also 


4 л? 2 
2 ( эг) > = 40%. (6.61) 


Since we are only interested in the asymptotic behavior for L — ee, the restriction 
L > 15 is immaterial for us, and the estimate (6.61) suffices for our purposes. 

For L > 19 we obtain from (6.59), (6.60) and (6.61) for the success-probability 
of measuring a z, such that the period r can be found as denominator of a partial 


continued fraction, as 
2 1 1 


Р з РНЕ 09 
{©} аат = тот 


(6.62) 
This completes the proof of the success-probability claimed in Theorem 6.8. 
6. Aggregation of the number of computational steps 


From Exercise C.117 we see that in general 
O(L%) +о(1%) e o(d) әрә. (6.63) 


The Steps 1 to 3 are executed successively and from (6.32), (6.34), (6.42) and (6.57) 
we see that, because of (6.63), the total number 54 (L) of computational steps for а 
successful execution of the algorithm A satisfies 
SA (L) € SPrep (L) $ Su; (L) st S'FOURIER (L) T S Part-CF (L) 
€ O(L) + O(LF) + O(L’) + O(L’) 
€ ошм) for L — оо. 


This completes the proof of Theorem 6.8. 
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6.5.5 Step 3: Probability of Selecting a Suitable b 


We now show that already after a few repetitions it is highly likely that the choice 
of a b < N will result in the event e; defined in (6.25), which is essential for a 
successful run of the algorithm. To show this, we first prove the following lemma. 


Lemma 6.10 Let p be an odd prime, k € N and s € No and let b be selected 
randomly from {с € (1,..., p*- 1] | gcd(p*,c) = 1} with equally distributed 
probability $ GS Then the probability that for a given triple (p,k,s) we find 
ога (b) = 2*t with an odd t satisfies 


1 
P{ ord, (b) = 25t with 2 in <5. 


Proof Let p,k and s be given. By Definition D.12 of the EULER function 6, the 
number of elements in (c € {1,...,p* — 1} | gcd(p*,c) = 1} is given by $(p*). 
Furthermore, there exist uniquely determined u,v € N with v odd such that 


o(p) — „р !(p-1) = 2%. 


_— 
(D.30) 


From Theorems D.25 and D.27 it follows that there exists a primitive root a € N for 
р“ and from Theorem D.22 it follows that 


(b € (1,..., p  — 1) | ged(p*,b) = 1} = (a! mod p*| j € {1,...,6(p)}}. 


Hence, via the identification 
b =a mod p* , 


the random selection of one of the equally distributed b is the same as the random 
selection of an equally distributed j € {1,...,@(p*)}. Moreover, we know from 
Theorem D.22 that 


o(p") 
ord (b) Е, (6.64) 
P вс@(/,ф(р®)) 
which means that the event ord (b) = 2*t is the same as 
Ев (6.65) 
© ged(j,2"v) | 


From (6.65) we can deduce that the case s > u cannot occur because in that case we 
would have 
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v —2* "t gcd( j,2"^v) 


and thus 2|v, which would contradict the assumption of an odd v in @(p*) = 2"v. 
Thus, one has 


P foray (b) = 25t with 2 ft and s > 2 =0. (6.66) 


For the case that s < и, we can deduce that j has to be of the form j = 2" ?x, where 
x is odd, as follows. Let 


n= || р" and m= [[»^ 


pePri pePri 


be the prime factorizations of n,m € N. Then 


gcd(n, т) = Il pmintVpHo} (6.67) 
pePri 


holds. Suppose j = 2"x with x odd. It then follows from (6.67) that 


ged( j, 2“v) = gmin(w,u) II р" (6.68) 
pePri « {2} 


with suitably chosen ку. In order to have ога (b) = 2t, then (6.64) and (6.65) 
require 
gcd(j,2"v) = yes (6.69) 


Since v and t are assumed odd, it follows that then Н has to be odd, too. From (6.68) 
and (6.69) it follows that min{w,u} = u — s and thus w = u — s. Because of this, j 
has to be of the form j = 2“—°х with an odd x and belong to {1,...,@(p*) = 2"v}. 
In this set there exist 2*v multiples of 2“~*, namely 


(2^5 x1,2*5 x2,...,2^ x Dy}. 


Of these 2°v multiples of 2^? only half are of the form j = 2" ?x with an odd x. 
The fact that all j are chosen with the same probability implies 


P {ога, (b) = 2t with 2 ft and s < 2 


Number of possible j of the form j = 2" x2 with x odd 


Number of possible j 
1 v 
52*'v 1 
2 s—u— 1 
2uy ~2 


since s < u. Together with (6.66), this yields 
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P {ога, (b) = 2t witht odd} 
=P [ora (b) = 25t with s > u and t odd) 


+P { ord, (b) = 2't with s < u and t odd) 
1 


1 
2 2 


< 0+ 


Lastly, in order to estimate the probability that our choice of b does not satisfy 
the criteria in (6.25) and we have to select a new b, we need the following result. 


Theorem 6.11 Let N € N be odd with prime factorization N = II pu 
consisting of prime powers of J different prime factors pi,...,py and let 
bE {c € {0,1,...,N—1} | gcd(c, N) = 1) be randomly chosen. Then 


at [ordy (b) even] and [oe я +1) тоам + o е = 


holds. 


Proof Since by assumption N is odd, all its prime factors p;,..., p; have to be odd 
as well, and we can apply Lemma 6.10 for their powers p . To abbreviate, we set 
r :— ordy (b) and show first 


P Í [r odd] or [062 +1) moan = 0]} < X 


From Theorem 0.28 we know that every b € (1,..., N — 1] with ged(b, N) = 1 cor- 
responds uniquely to a set of b; :— bmodp;/ € {1,... ‚рү! = 1} with ged(b;, pj) ==] 
for j € (1,...,J] and vice versa. An arbitrary selection of b is thus equivalent to an 
arbitrary selection of the tuple (b; = b mod pj! ,..., b; = b mod pj). 

According to Definition D.20, r = ordy (b) satisfies 


b' modN = 1. (6.70) 
From (6.70) it follows that there exists a z € Z such that b” = 1+zN = 1 zl pj 
and thus also 


b/ mod p; = 1. (6.71) 


Furthermore, we set rj :— ord vj (bj) for every j € (1,...,J). Then 
Pj 
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" y s v; 
1 ,— bj/modp;.— (bmod p!) / mod p; 
ef. rj Def. bj 


b"i mod p (6.72) 


[e| 


E 
Xt 


т 


мх 


holds, and we have for every j Є {1,...,/} in addition to (6.71) also 

b"i mod p; =1. (6.73) 
Since each r; is, by its definition, the smallest positive number satisfying the first 
line in (6.72), it follows that it also is the smallest number satisfying (6.73). Together 


with (6.71), this implies that for each j Є (1,...,J] there exists a kj € N with r= 
Куту. Conversely, every common multiple k of the r; satisfies b* mod N = 1 since 


1 
€Z Үјє 11,...,7} 


implies, because of gcd(pi, pj) = 1 for i Æ j, that also 


bk] 
m. 
IL»; 
such that b* mod N = 1. Since r is, by its definition, the smallest number satisfying 
b” mod N = 1, it follows that it is the smallest common multiple (see Definition D.3) 
of the r;, that is, 
г = sem(ri,...,rj). (6.74) 


Now let r = 2°t and г; = 2°/t; with s,s; € No апат and г; odd. Because of (6.74), r 
is odd (which is the same as s = 0) if and only if all r; are odd, which is the same as 
sj = О for every j € {1,...,J}. Consequently, we have 


rodd © s;=0 Vje(L...,J]. (6.75) 
Furthermore, because of (6.74) we have for all j € (1,...,J] 


sj Es. 


Let us now consider the case where r is even and (b? +1) mod N = 0, that is, where 
there is an / € N such that 


r 


Б +1= 1А. (6.76) 


Because of № = II. рї! ‚ it also follows that for every j there is an /; = 1-7 EN 
p n 


J 
such that 
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bi-l-lpy. (6.77) 


We know already that we must have s; < s and now show that (6.76) furthermore 
implies s; = s. To see this, suppose there is a j with s; < s, then it follows from 


Vt=r= kirj -kjXit 


that : 
kj = 258) — EN 
tj 
and thus , 
r __ 5$—5;—1 
Dd c 
j 
—— 
=zjEN 


since we are considering the case when r is even. Hence, for a j with s; < s there is 
az; € N satisfying 


Е 
2 = 23у. (6.78) 
Together with (6.72), this implies 
b? mod p! = "і mod py = С тоа p ) 7 mod p = ]mod рї 
(6.78) (0.22) (6.73) 
= 1. 


But this contradicts (6.77). Consequently, one has 
(b2+1)modN=0 = sj-s Vjelil...J). (6.79) 


Note that with our choice of notations we have for every j € (1,...,J] 
ord v; (bmod ру!) =r = 2t 
j 


where the /; are odd. Hence, a random selection of b entails a random selection of 
the sj, and for the set of events under consideration the statements (6.75) and (6.79) 


imply 


{rodd} C{s;=0 Vj} 
{ [r even] and [(b? + 1) mod N = 0]} C{s;j=sEN Vj} 


and thus 
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{ [r odd] or [[r even] and [(b? + 1) mod N = 0]] } Ci{sj=sENo Vj]. 


Since we can consider the choice of the s; as independent, we obtain for the proba- 
bility that r is odd or r is even and at the same time (b2 + 1) mod N = 0 holds 


Р{ [r odd] or [ғ even] and [(b? +1) mod N = 01) 


Ј 
< Р{5;=5Є № УЛ = У Pis-—s v} = у ЦПР{5у=›} 
scNo sENo j=l 
= Y Po =I TTP =9 
s€No 
ex Pis = [pel 27 with 
sENo === 
1 from Гетта 6.10 
1 
< È Р{я = daa I— ou 
s€No 
—— 


=1 


From this we finally arrive at the probability for the event e; defined in (6.25) as 


P{e} = Pl even] and [(b? + 1) mod N 4 0) 


= 1-р} [r odd] ог [[r even] and [(b2 +1) mod N = 01) 


1 


sleg (6.80) 


For a number N with more than one prime factor, that is, for the case J > 2, 
this implies that the у that with one selection we have found a b such that 


ordy(b) is even and (pe + 1) mod N Z 0 holds, is no less than } . For example, 
after ten trials the probability to find such a b is already bounded Шеш below by 
1— z = 0.999. 

If, however, N is a prime power, that is, if J = 1, we cannot derive any non-trivial 
statements from (6. 80) about the success-probability to find a b with the property 
that r is even and (b? + 1) mod N ¥ 0 holds as well. 
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6.5.6 Balance Sheet of Steps 


Proposition 6.12 For fp y(x) = Б modN there exists a unitary operator Ор, y 
on НА & HP satisfying 


Us, n (19^ ® |0)5) = [9^ & [fo.v (0)? (6.81) 


and the number of computational steps SU, y required for Uf, grows as a 
function of L = |21og; N| + 1 as 


Su, (D) €O(D) — forL e. (6.82) 


Proof The statement claiming (6.81) has been proven already in Corollary 5.47. 
To show (6.82), we only need to gather the computational efforts required for the 
operations which are used to build Uy, y- 

From Fig. 5.14 we see that for a quantum adder U, to add two numbers a,b < 2, 
we need to execute Us, U. and Už each O(L) times. Hence, the number of compu- 
tational steps scales for L — ee as Sy, (L) € O(L). The same holds for the quantum 
subtractor as the inverse of the adder. 

From Fig. 5.21 we see that the quantum adder modulo N requires a fixed number 
of quantum adders U , and subtractors U_ that is independent of a,b and N. Conse- 
quently, the number of computational steps for the quantum adder modulo N grows 
for L — ee as Sy, ,(L) € O(L). 

For a,b,c,N < 2L one has to perform O(L) additions U, to execute the quan- 
tum multiplier U,.-%, modulo N defined in Definition 5.43. Thus, the number of 
computational steps grows as Sy, „y (L) € O(L?) for L > ee. 

In Fig. 5.23 we see that A y, , for x < 2" is performed by executing O(L) quantum 


multipliers (7, вм. The calculation of the В; = b mod N for j € {0,...,L— 1} 
needed in the multipliers can be implemented classically in an efficient manner as 
follows. Because of 


b” mod N = (o mod N)? mod N 
Ww 
(D.22) eM 
the calculation of the b?’ mod N — QU mod N only requires L times the com- 
putation of expressions of the form a mod N in which a « N?. According to 
Lemma D.2, we need for each of these expressions O((log, max{a,N})”) e O(L”) 
steps. The number of computational steps for A у, y thus scales altogether for L — co 
as Ба, (L) e O(L?). 
Lastly, one sees from Fig. 5.11, that the construction used in Corollary 5.47 
for Uf, y requires the computation of Ap, and ARN a fixed number of times, 
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which is independent of №. We thus have also Su, (L) € O(L?) for x, N < 2” and 


L — оо, 


With these preparations we can now formulate the claim about the efficiency of 
the SHOR algorithm as follows. 


Theorem 6.13 For the factorization of an odd number М € N that has at least 
two distinct prime factors with the SHOR algorithm, the number of required 
computational steps Ssuog (N) satisfies 


Ssuor(N) € О((109› №)? log; log; N) N — оо, 


Proof First, we adapt the estimate (6.62) to a statement using N instead of L. 
Because of L = |2log, N| + 1, we have 


2log) N < L< 2log, N -1 (6.83) 
and thus 


1 1 
> А 
lnL ~ In(2log, N + 1) 


(6.84) 


Furthermore, because of (6.83) for L > 15, we have at least log; N > 7. Such N 
satisfy (log, №) 2 > 2log, N + 1 and we have 


1 1 1 1 
> 


= > , 
In(2log; N--1) ^ Hinlog,N 171121081085 ^ log;log;N 


where in the last inequality we have used H In2 « 1. Together with (6.84), this 
implies for L > 15 
1 1 


Ink ~ log, log, N ° 


and with (6.62), we have for L > 15 that 


1 
Р == 
отт 


The events relevant for the SHOR algorithm and their probabilities are collected once 
more in Table 6.7. The algorithm together with the required computational effort is 
then as follows: 
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Table 6.7 Relevant events in the SHOR factorization algorithm and their respective probabilities 


Instep | Event Description Probability 

1 el b has been chosen such that r is even апі | P {e1} > 1 
(Ь? +1) modN 5 0 holds 

2 е2 In the measurement of the input register | P {e2} > Tgog for 
H^ the state |z} for such a г> 19 ИШ 


z € (0,...,2- — 1) has been measured, 
that 3I. € (0,...,r— 1} with 
2—2 z| < gl and ged(L., r r)=1 


2 


p 
2 Follows from e2 | A partial continued fraction ^7 "T Ї of $ 7; has | P{e2} > ithe, ker for 
a denominator q; = r which is a кы г2 19 
of fon 
3 ei Nez A b < N has been chosen such that an P{e Ne} > 
r = qj has been found that is an even Wop log; N for r > 19 
period of fp y and for which 
(5 +1) mod N 5 0 holds 
SHOR Factorization Algorithm with Computational Effort 
Input: An odd natural number N with at least two distinct prime factors 


Step 1: Choose a b € N with b < N and calculate gcd(b,N). The number of 
computational steps required for this satisfies, according to (D.19), 


Ssuori(N) € O((log, №)?) for N — оо. 


If 


gcd(b,N) > 1, then gcd(b, №) is a non-trivial аа of N and we аге 
done. Go to Output and show gcd(b, N) and 


gcd(b,N) =1,then goto Step 2 


EI RI N) 


Step2: Determine the period r of the function 


fon : No — No 
n — fo (n) := b" mod N. 


For this we first calculate fp y 20 times by direct computation. Accord- 
ing to (D.4), the number of computational steps required for this is of 
the order O((log; N i In case this evaluation reveals a period r « 19, 
we continue with the case distinction following (6.85). Otherwise, we 
use the quantum algorithm given in Theorem 6.8. The number of com- 
putational steps required for this is, according to (6.29) together with 
Proposition 6.12, of the order O((log; N i Altogether, we have thus 


Ssnor2(N) € O((log;N)) м-ә. (6.85) 
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If 


ris odd, then start anew with Step 1 
ris even, then go to Step 3 


Step 3: Calculate gcd(b2 +1,N). The number of computational steps required 
for this satisfies, according to (D.19), 


Ssuor3(N) € O((log; N)?) for N — оо. 


If 


gcd(b? +1,N)=N, then start anew with Step 1 

gcd(b? +1,N) < №, ћеп with gcd(b? + 1, N) we have found a non- 
trivial factor of N. Calculate gcd(b? — I, N) as a further non-trivial 
factor of N. Go to Output and show gcd(b2 + 1). 


Output: Two non-trivial factors of N 


As we see from Table 6.7, the probability that b has been chosen such that the 
event еј (| e» occurs and thus factors of N can be determined satisfies 


1 
P{ } —— 
efez? > iog log; N 


To find suitable b and r with a probability close to 1, it thus suffices to repeat Steps 
1 to 3 approximately 20102; log, N times. 

Altogether, the number of computational steps needed to factorize N with a 
success-probability close to 1 growths as a function of N as 


Ssuon (N) € (Ssuoni (N | F Ssuor2(N ) + Ssuon3 (N))O(log, log, N) 
€ (O((log,N)*) + O( (log, N)) + O((log; N)*)) O(log, log, N) 
cee O( (log, N ) 105,108; N) for N — оо, 
(c2) 


Example 6.14 for the SHOR algorithm 


Input: Given N — 143 

Step 1: We choose b = 7 and find gcd(b, N) = 1. Hence, we proceed to Step 2. 

Step 2: The evaluation of f; y(x) = 7* mod 143 for x € {0,...20} shows that the 
period r of f, y is greater than 20. We set L = |21og; N| +1 = 15. 
In case we had a quantum computer, we would prepare the initial state in 
HSL, apply Uy, апа F and then observe the input register to read a z. The 
probability distribution for observing a z has the form shown in Fig. 6.4. 
We first find z — 7646 with a probability (6.46). The continued fraction 


representation (6.56) of 5 = = 166 is found to be 


300 


W(z) 
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0.0175 


0.0150 
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0.0100 


0.0075 


0.0050 
0.0025 
0.0000 


0 5000 10000 15000 20000 25000 30000 
2 


Fig. 6.4 Probability W (z), to observe a z € {0,.. — 1 = 32767} in the input register. The 
horizontal line shows the limit-probability Win from га 53). The vertical lines show the isolated z- 
values, for which the observation-probability is greater than Was. For all other z € (0,...,32767) 
the probabilities are smaller than 1076. The two dots show the z-values 7646 and 16930 that we 
have observed in the input register in this fictitious run of the algorithm 


7646 


IE = [0;4,3, 1, 1,272,2]. 


From the partial continued fractions (6.58) we thus find as possible can- 
didates k 


(Se) -2 | {1 3 4 7 1908 aa} 
215 | Lai’ aes  |4'13^1730' 8177’ 16384 f ` 

(6.86) 
Applying /ь у to ће qj from (6.86) yields fp м(9;) 7 1 for all these qj, 
in other words, none of the q; is the period of fp у. 


Hence, we prepare anew the initial state, apply Uy, „ and F and mea- 
sure the input register once more. This time we observe z — 16930. The 


continued fraction representation (6.56) of у = = 1990 } 
16930 
отс = 10:1,1,14,1,1,67,1,3]. 


For the partial continued fractions from (6.58) we now find as possible 
candidates for Е 


16930 
"( . )= 12...20 (6.87) 
2 qı 48 
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_ f 1 1 15 16 31 2093 2124 8465 
— |1'2'29'31' 60’ 4051’ 41117 16384 J ` 


Applying fp, to the qj from (6.87) shows that fp y(60) = 1. Conse- 
quently, we have found an even period r = 45 = 60 and proceed to Step 3. 
Step 3: In Step 2 we identified 60 as the period of fp y. We thus calculate 


gcd(7? + 1,143) 2 13 and  gcd(7? — 1,143) = 11. 


These are non-trivial factors of 143. Indeed, one finds 143 — 13 x 11. 
Output: The factors 11 and 13 of 143 


6.6 Generalizing: The Abelian Hidden Subgroup Problem 


It turns out that SHOR’s factorization algorithm is a special case of a wider class of 
quantum algorithms which solve what is known as the Hidden Subgroup Problem. 
In the following we present the algorithm to solve this more general problem with a 
quantum computer in the case of a finite abelian group. 

We begin with a general definition of a function hiding a subgroup before we 
turn to the special case of a finite abelian group. The group theoretical notions and 
results required for all material in this section are presented in Appendix F, and the 
reader unfamiliar with group theory is urged to read it prior to this section. 


Definition 6.15 Let H be a subgroup of the group S and let S be a finite set. 
We say that a function f : 9 — S hides the subgroup 3 if for any 21,2» € б 


Хі) №) e g mek. 


We can re-formulate the condition 81182 € H in terms of left cosets of H. 


Exercise 6.73 Let H be a subgroup of the group S and f : 9 — S, where S is a finite 
set. Show that then 


fhides H | & . Vgugs2€S8 Р) = (80) © st- 820. (6.88) 


For a solution see Solution 6.73 
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Hence, f hides H if and only if it is constant on any given left coset and takes 
different values on distinct left cosets of H. Consequently, if f hides a normal sub- 
group Ж, then it can be seen as an injective function on the quotient group 9/H (see 
Definition F.23). 

The Hidden Subgroup Problem (HSP) is defined as the problem to identify Ж 
as efficiently as possible with the help of f, that is, with as few evaluations of f as 
possible. 


Definition 6.16 Let f hide the subgroup H of the group б. The problem to 
identify H with the help of f is called Hidden Subgroup Problem (HSP). 

In case S is a finite abelian group it is called the Abelian Hidden Sub- 
group Problem (AHSP). 


In solving an HSP we would like to be as efficient as possible in the sense that we 
require the smallest number of queries (or evaluations) of the function f in order to 
determine Ж. Quantum algorithms have been developed to solve non-abelian HSPs 
efficiently (see [87] for a review), but here we will restrict our presentation to the 
АН$Р, in which case 


5 = {81,...,8191}, 


where |S| denotes the order, that is, the number of elements of 9. We define n := 
[log,|S|] and identify each element g; of the group 9 with a vector |е) of the 
computational basis in a suitable HILBERT space "IH", in other words, we choose a 
subset of the computational basis states the elements of which are labeled by group 
elements 


йу нез йд C (I9 xe (0,...,2^-1]) с 1°", 


such that 
(ailgx) = д. (6.89) 


With the |g;) chosen this way we define 
H^ :— Span (|g1),...,|gig) ) C 9°" (6.90) 


such that the {|g;) | l € {1,...,|S|}} form an ONB in H^. 

Furthermore, we define m :— |$| for the discrete and finite set S used for hiding 
the subgroup H < 9 by a function f : 9 — S. We also assume that the set < can 
be ordered and that we can identify each element s; € 5 = [so,..., ss 1) with its 
index. We denote this identification by ^, that is, we have the bijection 


~: s — {0,...,|5|—1} 


Sj — J 
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which we use to identify each element s; € S with a computational basis vector 


8) = |j) e HO" = HP. 
Hence, for any g € 9 we have 0 < f(g) « 2" and f(g) € (b) |y e {0,...,2%—-1}}. 
The first step in the quantum algorithm to solve the AHSP efficiently is then to 
prepare the initial state 
1 
|46) :2 —— У, [g^ 2 |0)? € H 9H”. (6.91) 
S| 269 


The precise computational effort required to prepare |) depends on the group 9 
in question, but for the efficiency of our quantum algorithm it suffices to assume a 
bound on the growths of the number of computational steps as follows. 


AHSP Assumption 1 We assume that the number of computational steps Sı 
required to prepare |P) as given in (6.91) satisfies 

S1(IS]) € poly (log;([S]) for |S| > ~. 
In the second step of our quantum algorithm to solve the AHSP we want to 


exploit massive quantum parallelism in order to evaluate f on all of б in one step. 
Hence, we make the following assumption. 


AHSP Assumption 2 For f : $ — S there exists an implementation of a uni- 
tary Uy defined by its action on the ONB 


{|g) @ly)|g€9,0<y<2"} c HeH” (6.92) 
as 
о а e (6.93) 
lg) & |y) — |g) & [vEB f(e)) ’ | 


and the number of computational steps 52 for the application of Оу satisfies 


52(|5|) € poly (log;(]|S]) for |S] = =. 


The second step of our quantum AHSP algorithm is then the application of Оу to 
|96) to produce 
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® = Ug Eom 
[S| ges 


У |g) @|f(g)) egt om. (6.94) 


api VIS] 
(6.92) SI seg 


After the first two steps in the algorithm the composite system is in the pure state 

= |) (4 |. We now ignore the sub-system ІН? and only observe the sub-system 
H4. Theorem 3.17 tells us that we then have to describe sub-system НА by the mixed 
state 


p^, — u^ (р) = u^ (94) (HI) , 


(3.50) 


where we have 


LANES У, (l8) & 1/6) (1 (FH) 
ЕП lg (kl Се) (709). (6.95) 


The matrix elements of р = |1) (| in the ONB of H^ @ HP given in (6.92) thus 
are 


ООЛ) @д. (99 


Pey,kz = = ХЕ 9) (ИКӘ), zs. iS 


met 22) 


The matrix of р^ in the ONB {g| g € 9} of H^ is then given by 


2n— , 
me y фт 
2"—1 
= igi! f()| 2, РО) = (ІЙ). (6.97) 


Sg 
(2.20) 


Since If (g)) and | F(k)) are vectors of the computational basis іп HP, they satisfy 


aa =, it /(k) = f(g) 


O else. 


We know from Exercise 6.73 that, because f hides K, we have that f(k) = f(g) if 
and only if k and g belong to the same left coset, that is, there is a € 9 such that 
k,g € gH. Since 9 is assumed abelian, left and right cosets coincide and we use the 
notation [4] с to denote the coset which contains $ € 9. Hence, 
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ETIN асыш 1 13269: gke|[g 
OIF) = » 
O else, 
and since such cosets are elements of the quotient group 9/3, (see Definition Е23) 
the matrix element Р in (6.97) then becomes 


1 
Phim È 1, _ 
ISl. gen 

s.th.: g,ke[£]c 


where the sum is over all cosets that contain g and k. The sub-system H^ is then 
described by the mixed state 


1 
A A 
р =, У legea. =, уу I У ge 
(2.21) 869 (6.98) € 9 0кє9/% 
s.th.: g,ke[£]oc 


K] 1 


S NEED PD 


We can express р^ more succinctly by defining for any g € 9 what we might call 
the coset state 


1 
[ФА у:=—— Y, |0 (6.99) 
[81 AK] к. 
such that | 
А А А 
= > О. (6.100) 
[819/9 


Exercise 6.74 Show that EOS as defined in (6.99) satisfies 


O else. 


] if = 
(е ЫЗ. = | opu (6.101) 


For a solution see Solution 6.74 


The next step in the algorithm is the application of the FOURIER transform as 
defined in Definition F.51 
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2, 2x6 (6.102) 


gcg хед 


Jm Я 


where we make use of 


and assume just as for the group G that we can also identify each element of the dual 
group (xi | l € {0,...,|S|}} = with a vector of the computational basis, such that 


[xs sap) = soles) € (12 | xe (0....,2^ - 1) CH, 
(6.103) 
and we have Fg : НА — H^, 
Applying the FOURIER transform (6.102) to the sub-system НА transforms the 
state of this sub-system as 
p^ e» Fap^ F3. 


Once more we make a generic assumption on the computational effort for this state 
transformation. 


AHSP Assumption 3 The number $3 of computational steps required to per- 
form the state transformation p^ > Fg р^Е& of sub-system НА effected by the 
FOURIER transform Fe given in (6.102) satisfies 


5з(|С|) € poly (log;(]|S]) for |S| >. 


The state of sub-system H4 after applying the FOURIER transform is thus 


* IH] | 
Fgp^Fá = iS У 6 WA, QM IFS 
(6.100) [25/€9/3€ 


787 2. 22x 


EX 

A 

ER. NS 1х) (8144 m 
(6102) V ШЕ: xc8 


s mm У, х(8)1х) (lo 


8S yeg kelglac 


LA X) 


= І) дк 
м ASK] 
(6.89) Sm 8S ye КЄ[@ 4¢ 
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= x(k 
у 2m. 
x(g x(g 
USER Xem em E Xen 


e 43) 


= ОУ x(g (6.104) 
(F.75) SI уел. 


such that the state of the sub-system НА is eventually given by 


FoR = ay У [У ою [ У FE). 6105) 


(213/€9/3€ \ хє" EEH 


Now, let ¢ € H+ and let |Ç) be the corresponding basis state in H^. Then P; = 
|6) (6 | is the orthogonal projector onto that state. According to (2.86), the probabil- 
ity to detect the state |Ё) when observing system НА, which has been prepared in 
the state Fgp^F2, is 


To observe |$) for a С € H+ in system НА when 
it has been prepared in the state Fg p^F3 


x r (IC) (C|Fap^Fz) 


У еа1)( )(6|Fgp"Fgea) , 


a 


p 
(2.5 
where we have used an ONB {e4} in H^. Using (6.105), we thus obtain 


To observe |6) for a б € H+ in system H^ when 
it has been prepared in the state Fg p^F3 


- E XE | Exon E (Elec) 


а |9| (£13/€9/9€ | хє éc9c- 
E 


=F x X (уар) сә 


(19/€9/3C£egc- \ а 


_ Hl Ет] = f 
Ze, iud е "X (g) 
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=, Y ie. (6.106) 
~< Isl PA 


Consequently, when observing the sub-system НА after the third step of our algo- 
rithm we will always find a state |) that corresponds to a character € € H+. 

Re-running the three steps of the algorithm L times, we can then apply Corol- 
lary F.50 to our observations of £;,..., Cj, € H+ to assert that 


> 1 = 1 : 
м 2L е LH] 


РЕ) 


Hence, after 


repetitions and observations, the probability that we have observed a generating set 
of H+ is no less than 1 — g, that is, 


Je E e 1—є. 


Finally, it follows from Theorem F.44 that we can find the desired H from the 
Observed generating set by 


L 
H= N Ker(¢). 


i=1 


Let us summarize the complete algorithm to solve the AHSP. 


Abelian Hidden Subgroup Problem algorithm with computational effort 


Input: A finite abelian group 9 and a function f : 9 — S that hides a subgroup 
4x8 
Step1: НАН, where 


H^ = Span{|g1),...,|g)g))} C 19%" 


with n = [log; |9|] and 
HE = H8” 


with m = [log; |S|], prepare the initial state 


1 
0) = —— У |) &|0) e g^ em. 


[S| ges 
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Step 2: 


Step 3: 


Step 4: 


Step 5: 


The computational effort required for this is assumed to satisfy 


SansP step 1(|9|) € poly(log;|S|) ^ for|S| > = 
Apply Оу of (6.93) to |Чу) to produce 
1 


3 У, lg elf(g) em em. 


8Є9 


|9) = б) = 


The computational effort required for this is assumed to satisfy 


SAHSP Step 2(|9|) € роїу (102 191) ^ for|8| > = 


Consider only sub-system НА, which when disregarding sub-system HË 
will be in the mixed state 


- A A 
P'- AS Mac) Fel! 
Ихе8/ж 


where 
| А 


1 
P = —— h). 
od) = gg 2, ie 


On this sub-system perform the quantum FOURIER transform Fg to 
transform sub-system НА into the state 


Fap^Fi = B |, *®®})( X see 
EHL 


8169/5 \ хє 
The computational effort required for this satisfies 
SaHsP Step 3(|G|) € poly (log; |9]) for |$| — ee 


Observe the sub-system H^ to detect a ¢ € H+ with certainty. 
The computational effort required for this is 


SausPsep4(|S|) € poly (10 |9|) for |9| — = 


Repeat Steps 1—4 for 
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times to determine C;,..., C; € H+ and from this 


L 
[| Кег(д). (6.107) 


i=1 


The computational effort required for this is assumed to satisfy 


Sausp Step 5(|S|) € роїу (102 191) for |S| > © 


Output: 
L 
H= N Ker(¢;) 


l=1 
with a probability no less than 1 — € 


The total computational effort for the AHSP algorithm grows as function of |G| 
as 


5 
SausP(|9]) = У, Sausp step ;(|9]) Є роЈу (108 |51) for || > e». 
j=l 


Quite a number of problems can be re-formulated as AHSPs [61, 87, 88]. Many of 
those play a role in cryptography, and finding a discrete logarithm in a group is one 
of them. 


6.7 Finding the Discrete Logarithm as a Hidden Subgroup 
Problem 


As we shall see below, the discrete logarithm plays an essential role in some of 
today’s most advanced cryptographic protocols. It is defined as follows. 


Definition 6.17 Let б be a group and g,h € б such that there exists a d € No 
such that 
h= р. (6.108) 


Then d is called the discrete logarithm of h to base g, and this is expressed 
by the notation d = dlog, (A). 

The task to find d = dlog,(/), when only g and and л satisfying (6.108) 
are known, is called the Discrete Logarithm Problem (DLP). 
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The use of discrete logarithms in cryptography is owed to the fact that, given g € 
S and d € No, it is quite easy to calculate Л = g^ simply by taking the group product 
of g with itself d times, but that it is generally extremely difficult to find d when 
given only g and Л. Hence, g and h can be published without revealing dlog g(h). This 
is what is used in the DIFFIE-HELLMAN [89] public key cryptographic protocol, 
which can be illustrated as follows. 


DIFFIE-HELLMAN Cryptographic Protocol 
Alice Bob Public knows 
mutually agree a g € 9 g 


selects a € N, calculates A = ^ selects b € N, calculates B = g^ 
and sends A to Bob and sends B to Alice A,B 


calculates the shared but secret calculates the shared but secret 
key К = В = 8% кеу К = д? = g^ 


At the end of the above protocol Alice and Bob share a secret key K. If, however, 
calculating the discrete logarithm were feasible for Eve, her knowledge of A, B and 
g would allow her to compute a — dlog, (A) and thus the key K — B" as well. 

As we now show, the discrete logarithm problem can be formulated as an AHSP 
for a suitably chosen group, set and function in the AHSP. Hence, a working quan- 
tum computer on which the AHSP algorithm is implemented would potentially ren- 
der the DIFFIE-HELLMAN cryptographic protocols insecure. 

The DLP that we solve with the help of the AHSP algorithm is as follows: 


Given: (i) а group Орр and an element g € Sp; p that has 
order N = ord (g), that is № € N is the smallest 
number satisfying 


g^ = egy, (6.109) 
(1) an h € Spip such that for some unknown d € N 


h — g (6.110) 


Find: d= dlog,(A) 


To find d, we set up a suitable AHSP and then execute the algorithm to solve 
it. As before, all group theoretical notions used here are defined and explained in 
Appendix F. 

The group 9 of the AHSP is not the same as the group Sprp in which we want 
to find the discrete logarithm. Rather, it is given as the direct product group of the 
quotient group Zy, that is, we set 


9 := Zy X Zy, 


where N is as given in (6.109). From Lemma F.5 it follows that |Zy| = N and from 
(F.38) that then in the case at hand 
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IS| 2 А2. (6.111) 
Any element g Є S is thus of the form g = (|х|, [v] yz). where [x]yz and [y]yz 
are cosets in Zy = Z/NZ. From (E.24) we know that for these cosets [x]y7 = 
[x mod N] yz. We use this to represent the elements of 9 as vectors in the HILBERT 
space НА given in (6.90) in the form 


Is) = K(Pdwz Dlyz)) = |xmod N) ® |y mod N) (6.112) 


and thus 
H^ = Span { |u) & |v) | u,v € {0,...,N—1}}. (6.113) 


As the set 5 in the AHSP, we choose 
$:= (6) < дыр, 


which in itself is a cyclic group of order М. 
For the function f we choose 


f: G — S 


.114 
(19м Bluz) — Ig" (6 ) 


where [х] yz, [y] yz, denote the cosets in the quotient group Zy = Z/NZ апа h,g € 
Gpe are as given in (6.110). Since л = gf, we find 


л: л) = (8) = a^^ € (в). 


To determine the subgroup hidden by f, note that we have for апу (|x]yz ,[v]yz) € 9 
and ([и| уа ,[v]yz) € S 


Р( (9м, , Plaz) +6 (nz: [У]мт.)) = f( Ало, [У]үл,) 


ә, (+, рУи) = Ала: ла) 
(Е.35) 
а(х+и)+у+у _ 4dxy 

ty & = 8 
(6.110) 

PN гй” = eg 

е (du-- v) тойм = 0 
м 

(Е.24) 
VUE [du t v|uz = [Oluz 
(F.24) 


= Уо = [7du]yz . 


6.7 Finding the Discrete Logarithm as a Hidden Subgroup Problem 313 


Exercise 6.75 Show that 
H= { ([u lal —du]yz) | [ulvz € Zu) (6.115) 
is a subgroup of G = Zy х Zy. 


For a solution see Solution 6.75 


Hence, H < S as given in (6.115) is the subgroup hidden by the function f defined 
in (6.114). For any g = (|х|, уут) € 9 its coset [g]4, with H is then given by 


[8] = {015+ dz Ly — du] yz) | [u]yz € 2м}. 


Moreover, the number of elements in this H is equal to the number of elements in 
Zn, and we have here 
[Xt 2 N. (6.116) 


With this the coset state for a [g]5, is given by 


1 

ШЕ. =, = У [(х+и) mod) ә (у – du) modN). 
J ы” N Z 

(6.99),(6.112) [u]wz € Zu 


Using (F.59) and (F.71), we find that the characters of б are given by 


Xm, : S mE U(1 ) 
тх+пу , 6. 1 17 
(knz: bly) > 2 TEM 


where m,n Є {0,.. — 1}. As assumed in (6.103), we use this to represent the 
elements of g as vectors in НА in the form 


|Xm.n) = |m) & |n) for m,n € (0,...,N— 1}. (6.118) 


Using once more (6.99) and the fact that |S| = N?, the FOURIER transform (6.102) 
then becomes 


jm XE 


Foo M е ш) әп) (v] (| 


Recall from Lemma F.39 that H+ = (X) }. and in the case at hand 
Jt is given by (6.115) such that for m,n € {0,.. — 1} we have 
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Xm,n Є HI e Xma([u]yz .|-du]yz) 2-1 V[u]yz € Zw 


‚ mu—ndu 


е еу =1 We {0,...,N—1} 
м 

(6.117) 

< m-dnmodN. 


Consequently, we obtain 
ЖЕ = { Xanmoan a| [yz € Zw] - (6.119) 


Moreover, (+ is actually a cyclic group generated by ул ү as is shown in the fol- 
lowing exercise. 


Exercise 6.76 Show that 
H+ = (да), (6.120) 


where d = dlog,(h) < N. 


For a solution see Solution 6.76 


We illustrate these constructions with a simple example to be worked out in Exer- 
cise 6.77. 


Exercise 6.77 Write down H and H+ for the case N = 6 and d = 3 as well as 
Ker(Y%mn) for Xm n € H+, and verify (6.120) in this particular case. 


For a solution see Solution 6.77 


The FOURIER transform of a coset state Lo given in (6.104) for the general 
AHSP algorithm now becomes for the discrete logarithm problem at hand for a 
8 = (Кл, Ума) 


1 
Ев Ке, ) = — у XdnmodN n(X1yz>l]vz)|dnmod N) & In) 
Dd ' 
(6.104) VN [t]yz €Zv 
1 2лї dnx--ny 
=, —— У e r |dnmodN) ®|n). (6.121) 
(6.117) VN [wz Zn 


For the mixed state (6.105) in which the sub-system НА is, we obtain 
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* = [H] * 
Fee FS = їй Э eio F 
1 И А А * 
= d X БЫА, MSIE 

e “шшен ^ Boet н 3 (6.122) 


= 1 2лі BY (n—m) 
= 1v > EEN |dn mod №) (dm mod N| & |n} (m| , 
c М севу 
тугу 2 


where, as before, g = ([x] yz .|v]wz) € S. 


Exercise 6.78 Let u,v € (0,..., N — 1} be such that 


Puy = (|и) ® |у))((и|® (у) = lu) ul @ Iv) V], (6.123) 


WY 
(3.36) 


in accordance with (6.113), is an orthogonal projector onto a state |u) ® |v) € H^. 
Show that then 
| (uldv mod N)? 


E (6.124) 


tr (Pu Fsp^ Fg) = 


For a solution see Solution 6.78 


From (2.86) we know that the probability to measure the state |u) ® |v} when observ- 
ing the system H^ when it is described by Fa p^Fš is given by the left side of 
(6.124). From (6.118) and (6.119) we know that the states which represent char- 
acters in H+ are of the form |dn mod N) & |n), where n € {0,...,N — 1}. Conse- 
quently, 


When system H^ is prepared in N-1 
P Fsp^Fz and measured, a state cor- = у tr (Pansiod v FS pA Fe) 


responding to a y € H+ is detected n=0 


Е S (dn mod N|dn mod N) |? 
Y n-l N 
(6.124) "= 
= 1 


2 


which tells us, as already ascertained in (6.106) for a general AHSP, that we will 
always find a state corresponding to an element in H+. 

Rather than employing (6.107) to find H and then d = dlog, (Л), we can deter- 
mine d more directly in the DLP version of the AHSP as follows. From (6.119) we 
infer that finding a state corresponding to an element in H+ means that we have 
found states of the computational basis of the form |dn mod N) & |n) € НА where 
n € (0,...,N — 1). Hence, after one execution of the AHSP algorithm for the DLP 
we know a pair of numbers (dn mod N,n) with n € (0,...,N — 1). 
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Now, suppose gcd(n, N) = 1. From (D.19) we know that the computational effort 
to calculate gcd(n,N) scales as poly (log, |9|). The probability for ged(n, №) = 1 to 
occur can be bounded from below away from zero as can be seen from the following 
theorem, which we quote without proof. 


Theorem 6.18 ([90] Theorem 332) Let m € М, and let p,q be selected inde- 
pendently and with uniform probability from (0,...,m — 1) C N. Then we 
have 


6 
im P {ged(p, q) ee => 0.6. 


From Lemma D.9 we then know that we can employ the extended EUCLID algo- 
rithm to find the inverse of n modulo N, that is, the number denoted r^! mod N that 
satisfies ((n(n^! mod N)) mod N = 1. From (D.11) we can infer that the computa- 
tional effort for this is of order poly (log, |9|). Having obtained n^! mod N, we can 
use it to compute d dlog, (h) as follows 


((dn mod N) (n^! mod N)) mod N (апп! mod N) modN, = d modN 
маре 


Ww 
(D.20) (D.8) 


= d, 
where in the last step we used that from (6.109) we can infer that d < М. 

If, however, gcd(n, N) > 1, we repeat the algorithm to find a second pair 
(dm mod N,m) and determine gcd(n, т). If gcd(n,m) > 1, we repeat the algorithm 
again and again until we find a pair, such that gcd(n,m) — 1. As can be seen once 
more from Theorem 6.18, the probability for this to happen is greater than 2, and 
the number of potential repetitions of the algorithm does not alter the overall com- 
putational effort from poly (log, |9|). 

Assuming then that we have a second pair (dmmodN, m) such that gcd(n,m) = 1, 
we can employ the extended EUCLID algorithm of Theorem D.4 to find integers a,b 
such that (D.12) ensures 


an 4- bm = gcd(n,m) = 1. (6.125) 


Consequently, we have 


a(dn modN) + b(dmmodN) , — , d(an- bm) (а | Td Fal 
(D.1) 
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and thus, since 0 < d < №, we can use the known integers dn mod У, ат mod N, a,b 
to obtain 
(a(dn mod N) + b(dm mod N)) mod N = 4. 
Кр 


(р.1) 


This shows that we can indeed use the AHSP algorithm to solve the DLP. We now 
turn to show how such a solution of the DLP could potentially render the bitcoin 
transaction signature protocol unsafe. 


6.8 Breaking Bitcoin Signatures 


In today's digital world it becomes increasingly important to be able to sign doc- 
uments digitally, in other words, to add a digital signature that cannot be forged 
but which can be verified to a document. This is accomplished by so-called digital 
signature algorithms (DSA), which constitute cryptographic protocols by which a 
signer can authenticate a publicly known document and provide the public with a 
means to verify the authentication. The scheme of such protocols is as follows. 


Digital Signature Algorithm (DSA) Protocol 
Signer Public knows 
algorithm parameters A 
verification statement v 


chooses a private key К 
creates a public verification key 
by 
computing a V = V(k, A) 
and publishing it verification key V 
signs document by 
taking document d, document d 
computing a signature s(d,A) 
and publishing it signature s 
and can verify by 
checking the verification statement v(s,d,V,A) = TRUE? 


The security of this protocol relies on the difficulty with which the secret private key 
k can be obtained from the knowledge of the public verification key V = V (k, A) and 
the publicly known algorithm parameters A. 

If k could be found by a fraudster, he could publish altered or new documents 
with a valid signature by the signer and the public would be made to believe that 
these documents were authenticated by the signer. 

A widely used version of such a DSA is based on the difficulty to find discrete 
logarithms for elements of elliptic curves (see Definition F.56). This is known as the 
Elliptic Curve Digital Signature Algorithm (ECDSA), and a version of it is used for 
creating the digital signature of transactions conducted with bitcoins [79, 91]. 
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With the help of a suitably chosen elliptic curve the ECDSA provides a document 
authentication protocol for a document in the public domain. Prior to input into the 
ECDSA these documents are standardized by a so-called hash function. Such 
hash functions deterministically map input of arbitrary length to output of fixed bit- 
string length. For cryptographic purposes it is desirable that small changes in input 
produce significant changes in output and that it is extremely improbable that two 
distinct inputs produce identical output. 


Example 6.19 An example of a hash function provided by the NSA is the Secure 
Hashing Algorithm SHA256 which converts any ASCII into a 64 digit hexadecimal 
string. As an example consider the following text. 

The SHA256 hash output of the text in this line in hexadecimal form displayed 
across two lines is: 


A3C431026DDD514C6DOC7ESE B253D424 
B6A4AF20ECOOA8CACBESEST239BBB848 


Such a 64 digit hexadecimal string can be interpreted as a 256-bit natural number d, 
which in our example would be (given in binary format first) 


d 
—(10100011110001000011000100000010011011011101110101010000000 
00000000000000000000000000000000000000000000000000000000000 
00000000000000000000000000000000000000000000000000000000000 
00000000000000000000000000000000000000000000000000000000000 
00000000000000000000) 


—7.407363459482995... х 1076 < 2256. 


The hash functions used for pre-processing the documents are part of the algorithm 
specification of the ECDSA in the public domain, and we may thus assume that the 
document to be signed is given as a positive integer not exceeding a known upper 
bound N, such as № = 2256 in the case of SHA256 in Example 6.19. 

ECDSAs are usually based on elliptic curves E(F,,) for which p is a large prime. 
From Corollary F.59 we know that for a prime p the elliptic curve E(F;) over the 
finite field F, = Z/pZ together with the addition +g given in Theorem F.58 forms 
a finite abelian group such that we can define addition of two points P,Q € E(F;). 
In particular, we can add P to itself k € N times to obtain 


kP=P+gP+g +EP. 
eS SS 


k times 
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In addition to the hash function, the protocol for ECDSA then requires the specifica- 
tion of five publicly known parameters A = (p,A,B, P, q) consisting of the following 
items. 


ECDSA Parameters (p,A,B, Р, 4) in the Public Domain 


1. A prime p specifying the finite field F, 
2. Two elements А,В € FF, specifying the WEIERSTRASS equation 


y? =x +Ax+B 


of the elliptic curve E(F,,). This is an equation in the finite field F,. The under- 
lying set of F, consists of cosets in Z/pZ 2# Zp. From Lemma F.5 and Exam- 
ple F.19 we know that any such coset (or equivalently element in Z,) can be 
uniquely identified with a number in (0,..., p — 1}. Hence, we consider A and B 
and the components x and y of elements P = (x, y) € E(Fp) \ {0g} as elements 
of the set (0,...,p— 1} 
3. An element 
P= (xp, yp) € Е(Е,) ^ {05} C F, x F,, 


which is often called the base point of the ECDSA 
4. The element P is chosen such that it has prime order, that is, 


а = ord(P) := min {n € N| nP = 0g € E(F,)} (6.126) 


is a publicly known prime 


Given a document d in the appropriate format, the process steps of ECDSA can then 
be divided into the three sections Public Key Generation, Signature Generation and 
Verification as follows [92]. 


ECDSA Public Key Generation 


1. Select a private key 
k€11,...,q4-1] CN 


2. Compute the verification key 
V —kP € E(F5) ~ {0}. (6.127) 


Note that V Æ Og since k < q, and q is the smallest number such that qP = Ок 
3. Publish the verification key V € E(F5) ~ {0z} 
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ECDSA Signature Generation 


1. Select a natural number 
a€ (1,...,9-1] (6.128) 


2. Compute 
аР = (Xap, yap) € E(Fp) {Ок}, (6.129) 


where, as above, we are guaranteed aP Æ Og since a < q, and we consider xap € 
F, to be represented by a number in (0,...,p— 1} 
3. Compute 
51 = Xap modq € (0,...,4—1] (6.130) 


4. If sı = 0, go back to Step 1 of the signature generation and select a new a € 


(1,...,4—1]. 
If sı Z 0, calculate the multiplicative inverse of a modulo q 


á—a !modq € (1,...,4—1] (6.131) 


defined in Definition D.8, that is, the number @ such that ай тойд = 1. Note that 
since a € (0,...,q— 1} and q is a prime, we always have gcd(a,q) = 1 and the 
multiplicative inverse exists. 

With à compute 


s2 = ((d -- ksi)a) modq € (0,...,4—1) 


5. If s2 = 0, go back to Step 1 of the signature generation and select a new a € 


(1...,4—1]. 
Else, set the signature as 


($1,523) € {1,...,g—1} x (1,...,4— 1] 
6. Publish the signature (51, 52) 


Before we turn to the verification procedure, we first show that the statement which 
will be tested in the verification query is indeed true. This is done in the following 
proposition. 


Proposition 6.20 Let (p,A, B,P,q) be parameters of an ECDSA with elliptic 
curve E(F,), let d € N be the document to be signed, and let К,Ү,а,а, 51,52 
be as given in the ECDSA public key and signature generation. With 
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$2 = Cen modq 
uy = d$; modq (6.132) 


ил = 515 modq 


it then follows that 
uP + uV — aP 


and thus for (x,y) = uP + uV that 


xmodq = 51. (6.133) 


Proof То begin with, we note that from (D.1) we know that for any р € Z there is а 
z € Z such that b = b mod q + zq and thus 


bP = = ; А 
(bmodq)P+zqP (bmodq)P (6.134) 
(6.126) 
Next, we have 
ujP-FuojV | — шР+изКР = (u; +u2k)P 
(6.127) 
=, (ш + иок) mod q)P. (6.135) 
(6.134) 


The coefficient of P in the last equation of (6.135) can be evaluated as follows 


(ш +u2k) тойд = (d$ mod q+ (5152 mod q)k) modq 
(6.132) 
((d + 51)5) тойа 


((d - siK)((d 4- sik)8) ! тойд) тойд 


ze E 
a тойд, = amodq 
(D.8) (6.131) 


a, 


(6.128) 


which, inserted into (6.135), shows that uj P + u2V = aP. This in turn implies that 


(XaP,Yap) = aP = ui P +V = (х,у) 
(6.129) 


such that the claim (6.133) follows immediately from (6.130). 


322 6 Onthe Use of Entanglement 


Note that the left side of (6.133) can be calculated from the publicly available 
information p, A, В,Р,9,У,4, 51,52 and the right side sı is also publicly known. 
Hence, the veracity of (6.133) can be verified with the help of publicly available 
information and it constitutes the verification statement. 


ECDSA Verification 


1. Compute 
5 = sj! тойд 
uj = d$; тойд 


ил = 8152 mod q 


and with these calculate 
(x, y) = uj P + uV 


2. Check if > 
хтойд = sı 


is true. If it is, then (51,52) constitutes a valid signature of the document d. Oth- 
erwise, it does not 


An ECDSA protocol can be summarized as follows [79]. 


Elliptic Curve Digital Signature (ECDSA) Protocol 
Signer Public knows 
algorithm parameters .А: 
large prime p 
elliptic curve E (Fp) 
public point P € Е(Е,) ~ {Oz} 
with a large prime order q 


creates key by 
choosing a secret signing key k ЇЇ 
with 1 « k « q, 
computing the verification key V — kP 
and publishing it verification key V 
signs document by 
taking document d and a random a € N with a « q, document d 
computing 
aP € E(F,) ~ {05} 
81 = Xap modq 
s2 = ((d +551) (a^! mod q)) тойд 
and publishing the signature (1,52) signature (51,2) 
and verifies by 
computing 
u = (4(s;! mod q)) тойд 
из = (si(s5! mod q)) тойд 
(х,у) = uP +g mV € E(F5) \ {Oe} 
and checking the verification statement 
is x modq = s; TRUE? 


6.8 Breaking Bitcoin Signatures 323 
In Definition 6.17 we defined for any V,P € E(F,) such that V = kP 
К = dlogp(V) 


as the discrete logarithm in Е (F,) of V to base P. The security of ECDSA depends 
on the fact that it is very hard to calculate the discrete logarithm for this group. If 
it were feasible to calculate the discrete logarithm in a relatively short time span, 
then ECDSA would become insecure. This is because V and P are in the public 
domain, and anyone who can calculate the elliptic curve discrete logarithm from 
the publicly known V and P would obtain the the secret signing key k. With this 
key any fraudster could forge the signature of the signer. In other words, they could 
publish an alternative document d, perform the signing procedure on this document 
d, publish the new signature (51,55), and the public would believe it were from the 
signer who has published V. For example, in the context of bitcoins a fraudster could 
submit a new transaction to the blockchain claiming that the signer has transferred 
bitcoins to him. 


Example 6.21 Bitcoins use the secp256k1 ECDSA [93] protocol with the WEIER- 
STRASS equation defined by A = 0 and B = 7, that is, 


yw 


the prime 
ж=27°—03®—99 98 o eda req (6.136) 


and the public point P = (xp, yp) given by 


Хр = 550662630222773436695787188951685343262506034537775941755001 
87360389116729240 

Ур = 32670510020758816978083085 130507043 18447 12733806592432759389 
04335757337482424. 


The best known classical method to calculate k = dlogp(V) for Е(Е,) requires 
O(,/p) computational steps and thus for the bitcoin ECDSA of the order of O(1077) 
computational steps. In contrast, a quantum computer could potentially calculate 
k = dlogp(V) for E(F;) requiring only 


O(polynomial in log;(p)) O(polynomial in 256) 


<> 
(6.136) 


computational steps and thus render the bitcoin signature insecure. 
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6.9 GROVER Search Algorithm 


The search algorithm developed in 1996 by GROVER [21] describes a method in 
which known objects (‘needles’) can be found in a large unordered set (‘haystack’) 
of N objects. The method achieves a success-probability greater than 50% in 
O(VN) steps. Previously known methods required 0(%) steps to find the object 
with such a probability. 

For example, if we wanted to find the name belonging to a given phone number 
in a phone book of four million entries, the GROVER search algorithm would have 
а success-probability greater than 50% after 0(2 х 103) steps, whereas the previ- 
ously known methods would require o(2 x 10°) steps to achieve the same success- 
probability. 

The GROVER search algorithm begins by representing the objects as quantum 
states, in other words, normalized vectors in a suitable HILBERT space. The vec- 
tors of the objects which we try to find span a subspace in this HILBERT space 
and the algorithm constructs operators that successively transform (or ‘rotate’) a 
given initial state into a state which has a maximal component in the subspace of 
desired objects. This implies that, when measuring the rotated states, we have a 
greater probability of detecting a state which lies in the subspace of desired objects. 
This method of rotating the initial state into the solution space is also used in other 
quantum algorithms and has become known as amplitude amplification. 

In the following we first present this method in Sect. 6.9.1 for the case where 
the number of objects we are searching for (aka 'solutions') is known. In case the 
number of possible solutions is not known, a modification of the algorithm allows 
to perform a search with a success-probability of at least 2596. This is discussed in 
more detail in Sect. 6.9.2. 


6.9.1 Search Algorithm for Known Number of Objects 


We assume that the objects of the unordered list in which we search can be identified 
by numbers in {0,1,...,|Z|}. In case the cardinality |L] of the list is less than 2", 
we supplement the list with 2" — |L| placeholder objects such that, without loss 
of generality, we may consider a search in the set {0,...,2” — 1} with cardinality 
N := 2". Since every number x € (0,...,2" — 1} can be uniquely associated with a 
vector in the computational basis of HE”, we can execute the search in "IH" if we 
succeed to suitably identify the objects we are looking for in this HILBERT space. 

We denote the set of the m objects we are looking for by S. By allowing т> 1 
we also permit the case where there is more than one solution. 
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Definition 6.22 Let S denote the set of objects we are searching for, and let 
m > 1 be the cardinality of this set. The set S is called solution set, and we 
call its elements solutions. For the algorithm to search an x € S С (0,...,N — 
1}, where N = 2", we define the input and output register as H’ /0 — — He", 
Furthermore, we denote the set of objects that are not a solution by 


S- = (Oe ls 
and define the subspaces 


Hs := Ѕрап {|х) | хє8) сн! 
Н: := Span { |х) | хє S cH 


and the operators 


Ps := X has 
xeS 
6.137 
P= У, 01 o 19 - D 
xeSt 
on H//? as well as the vectors 
M) = —— Y.» 
e im X 
vm 
1 5 (6.138) 
|51) = |x) 
N —m ес 


in H//0, 


The subspace Hs is spanned by vectors corresponding to objects in the solution 
set S. The operator Ps is a projection onto this subspace because Ps|) = |^) for 
any |V^) € Hs, and it satisfies the requirements of an orthogonal projection given in 
Definition (2.11), that is, 


P5 = » но) = 2, (961) x x) | = 


as well as 


в= peo = У 0801= У lx) Gl = 


xyes (3. me xES 
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Analogously, P5; is a projection onto the subspace Н! spanned by vectors corre- 
sponding to objects which are outside of the solution set 5. 

The state |Ҹ5) is an equally weighted linear combination of those vectors |x) of 
the computational basis that are solutions x € S. An observation (see Definition 5.35) 
of this state will reveal a [ds with certainty. 

Because of SU S+ = (0,.. — 1}, every state |P) € H//? can be expanded in 
the computational basis as a 


(P) = (Р, +Р5)|Фу= У Ep) + > Bh), (6.139) 


xeSt xES 


where ¥% € C. An observation of the input/output register HI! /O in a state |W), that 
is, a measurement of the observable X/ defined in Definition 5.35, projects this state 
onto a |x) and yields an observed x. It is the goal of the algorithm to create states |) 
for which the probability to observe an x € S is maximized. This is accomplished 
by starting from an initial state |o} and by applying suitable transformations (aka 
'rotations") which increase the component in Hs. The probability to observe an x € S 
when observing |) is given by 


2 
Observation of |^) projects 
{ onto a state |x) with x € S IPs? DIP = || 2% хр) 
om 62) aie 1371€ 
ELIR. (6.140) 
~ns 


(2.14) 


The search algorithm consists of a construction of a sequence of transformations that 
generate a |) from an initial |o} such as to maximize the right side of (6.140). 

Before we can discuss this in more detail, we need to introduce a method to 
identify solutions. For this we assume that we can decide in a limited number of 
computational steps, which is independent of N, whether an x € {0,...,N — 1} is 
a solution. We assume that this decision is accomplished by the application of a 
function g which yields g(x) — 1 if x is a solution and g(x) — 0 otherwise. Fur- 
thermore, we assume that this function can be implemented on a suitable HILBERT 
space with the help of an operator which also can be executed with a limited number 
of computational steps that is independent of N. 


Definition 6.23 Let S be the set of solutions with cardinality m > 1. For the 
algorithm to search for an x € S C (0,..., N — 1), where N = 2", we define 
the function 


£:(0,...,N — 1) — {0,1} 
0 ifxe St (6.141) 


| = [0 ies 
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as the oracle-function of the search problem. With the help of the auxiliary 
register H = "Н we define on H//? c H the oracle (7, via the following 
action on the computational basis 


Ue (|x) & |у)) := |x) & [v e). (6.142) 


By linear continuation, (7, is then defined for all vectors in Н//О & HW. 


As mentioned above, we assume that the oracle Ü, can be efficiently executed, 
that is, with a finite number of computational steps independent of N. According 
to Definition 5.29 and Theorem 5.28 we can implement with Ü, an operator on the 
sub-system Н//О. 


Lemma 6.24 For the oracle mn and the state 


|o) = |) = |) = "= 


in the auxiliary register HY one has for arbitrary | V) є Н!/° 


0, (|) &|-)) = (Rgi|¥)) @|-), (6.143) 
where 
Rak = У Eo = Y Eo) 
xest xES 
= (18% _2р;)|Ҹ). (6.144) 


Proof То begin with, we have 


Us ( 


Ül9el)) = Welle) 


{ |х) @|1), ifxeSt 
(6.142),(5.81) (6.141) | 


х) @|0), ifx ce S. 


The oracle 0, then acts on the states 


юв) (2) 
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іп H//? & HV as follows 


Uz (|x) ®|-)) =, 
(6.145) 


= (-1)8|x) @|-). (6.146) 


|х) |), ifxeSt 
р) &|-), хє 5 


Together with (6.139) it thus follows for a |Р) € H//? that 


#)®|—)) =, (X ms) Xo) ®|—) 


(6.139),(6.146) МхЄ8+ E 
(Ps — P5)|')) ®|—). 


Because of Ре + Ps = 1*" this implies (6.144). 


Note that Rg. reverses the component Р |У) of |Ҹ) in the space Span { |х) | xE 
S} in the opposite direction — Р5 |”). This can be viewed as a reflection about Hg., 
where a reflection about a subspace is generally defined as follows. 


Definition 6.25 Let Н, ць be a subspace of ће HILBERT space Н, and let Р, ць 
be the projection onto this subspace. The reflection about the subspace Н. ць 
is defined as the operator 


Key оК ЫЕ (6.147) 


If the subspace is one-dimensional and spanned by a |^) € H, we simply 
write Ry and call this a reflection about |”). 


Note that the projection onto the orthogonal complement H „p1 of Hsub is given 
by P ap} = 1— Psub such that the reflection R about H b 1 becomes 
R 


sub. 2P ubt —1= 2(1 Ра) 1=1—2Рь = -—Ryp. 


(6.147) (6.147) 


Figure 6.5 illustrates the geometry of these constructions. 
For the start of the search algorithm we have to initialize the input/output register. 


Definition 6.26 Let 5 be the solution set with cardinality m > 1. For the algo- 
rithm to search for an x € S C (0,..., N — 1}, where N = 2", we define the 
initial state in the input/output register as 
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Fig. 6.5 Geometry of the reflections of a vector |”) € H about a subspace Hus and its orthogonal 
complement Н, „p4 


1 
(H) = У |хуєн//0. (6.148) 


Moreover, we define the angle 


^ m T 
Өр :— arcsin (уз) € |o. =| | (6.149) 


and with the help of |Y) we define the operator 
Ry = 2|%) (96| — 17" (6.150) 
on H// as well as the initial state in the composite system 
І) :— |m) & |-) н/о gH”. (6.151) 
The initialization of the input/output register in the state |Ҹ) can be performed 


as described in Sect. 5.4.1 with the help of the HADAMARD transform as shown 
in (5.83). 


Exercise 6.79 Show that 
|'%) = cos 0| V5.) + sin |) (6.152) 
holds and that Ry, is a reflection about |). 


For a solution see Solution 6.79 


The transformation that increases the component of |) in Hs is defined as follows. 
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Definition 6.27 The GROVER iteration is defined as the operator 
G:= (Ry, e 1) Ü А 

on H!/° 9 H”. 

As we will now show, the GROVER iteration G transforms separable states in 
H!/° @H of the form І) = = |^) & |—) to separable states (Р) = = |01) ®|-) 
of a similar form. We will see that in the input/output register H!/° an application 
of G can then be viewed as a rotation of 200 in H//9 in the direction of |Ч$). 
Consequently, repeated application of G increases the component along |Ҹ5) in the 
resulting state and thus the probability to find a solution upon observation of the 
input/output register. 

Proposition 6.28 For j € No let 

IP) = G'I). 


Then we have for all j € No 


|9) = |) @|-) (6.153) 
with |) € H!/? and 
|'%;) = cos 0; |s) + sin0;| V5) , (6.154) 
where 
BS Qe (6.155) 


Proof We show this by induction in j, which we start at j — 0. From the definition 
of |) in (6.151) and the result (6.152) we know that (6.153)-(6.155) are already 
satisfied for j = 0. 

For the inductive step from j to j 4- 1 assume that for a j € No 


|£;) = (cos 6/95.) + зїп Ө;|ЧЄ)) ® |-) 


holds with Ө; = (2j + 1)0. Then we have 
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IE) = ОФ) 
= (Ry, & 1)б, | (cos Ө.) + іп) ® |-)] 
E (Ru, & 1) | (cos 619.) — sine; p) &1-)] 


= (( 21%) (Ho — 1") (cos Ө.) — sin ө]%))) @|-) 
(созө;( 2/96) (091%) — |ы. ,)) 


— sin 6; (2|%) (155) = ))) &|-) 


= |+) |) 
with 
|1) =  cos0;(2]96) (|51) —|Ҹ5:)) — sin 6; (2/40) (%]%) —|'%)) 
—— HSS 
—cos ĝo =sin Ө) 
= cos 6; (2(cos 8|.) + sin Ө] %;)) cos Ө — |.) 
(6.152) 
— sin 6; (2(cos ӨЧ.) + sin @|"¥6)) sin 8 — [V)) 
= (cos 8; (2cos? 6 — 1) — sin6;2cos 6 sin 6 ) V.) 
——— ee SES 
=cos 209 —sin20p 
+ (cos 8; 2cos 6 sin Ө; + sin8;( 1 — 2sin? 69) )|%) 
ee SEES ——— 
=вїп 20) =cos 20 
= (cos 6;cos 26 — sin @; вїп 20) |%. ) 
+ (соз Ө sin 20 + sin Ө; cos 26) |'¥) 
= cos(0; + 205) |.) + sin(0; 4- 209) |V5) 
= cos Өу+1| ЧЄ) +ѕіп 0/1195) 
and thus finally 


054 = Ө; +20 = (2}+1)6% +26, = (26-1) +1). 


Hence, (6.153)-(6.155) also hold for j 4- 1. 


The geometry of the sequence of the |) is graphically illustrated for an example 
in Fig. 6.6. 

As shown in Proposition 6.28, the j GROVER iterations transform the composite 
system H!/° & HV from the initial state LES |) & |—) to the separable state 
P) = = |Ф)) ®|—). From Theorem 3.17 we know that then the sub-system in the 
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Ѕращ |Ҹ)} 
(Piy) 
A 4 
196) 
№) 


Ѕрап{ | Yi) } 


Fig. 6.6 Geometry of the GROVER iteration in the input/output register with m — 5,N = 2!° 
and jy = 11. In the two-dimensional subspace Span{|'¥.),|'%)} the initial state |Y) is rotated 
towards |5). The illustrated transition from |\Р;) to |%) shows that G in the sub-system / /O first 
performs a reflection about |.) and then a reflection about |). The vector immediately to the 


right of |Ф)„,) is | V6) and is a state in the subspace His of the solution set. We can see that |P; } 
comes close to that 


input/output register is described by the reduced density operator 


pl? = ш” (1850) = (1%) ®|—)(Ф]®(—) 


(3.50) 
=,” EHIS |) 7 D, — (7) CD IE (25 
(3.36) (3.57) 
= wy. Tom) 


where in the last equation we used that (|--) } is an ONB in Н” = "Н and thus 
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ҥ(—)(—[) 


и заза зоа 


Z 
2.57) 


From (6.156) we see that the sub-system in the input/output register Н! /O after J 
GROVER iterations is described by the pure states |7; 1). We can thus ignore the 
auxiliary register IH and restrict our considerations to the input/output register. 

When observing the input/output register in state |) the probability to find a 
state |х) for which x is a solution is determined by the projection of |‘¥;) onto the 
sub-space Hg spanned by vectors corresponding to the solution set. Using (6.154) 
we obtain 


Observation of |) projects | _ m _ E 
BE р) withxeS | - ||2s1;) || S ше em 
(6.137),(6.138), 
(6.154) 


To optimize the success-probability of the peat we need to determine the number 
j of applications of Соп E that maximizes sin? 0; j, which, as shown in (6.157), is 
the probability to find a solution. The following lemma gives a lower bound for this 
probability if we determine j such that Ө; is as close as possible to 7. 


Lemma 6.29 Let S be the solution set with cardinality m > 1, and let М — 2" 
be the number of objects in which we search for solutions. If we apply the 


GROVER iferation G 
Jm | Ex | (6.158) 


4arcsin (4/7) 


times to |) and observe the state [V,,) in the input/output register, then the 
probability to observe in the sub-system H!/° a state |x) with x € S satisfies 


Sea (6.159) 


N 


Observation of |P;) projects 
onto a state |x) with x € S 


Proof Because of Ө) = arcsin (Л) ‚ the choice (6.158) is equivalent to 
2] z 
55 400 | 


н< ag <int1 


With this choice we have 


and thus 
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л Я 
E 57 (2j + 1)Ө0 < Өө, 


which implies 
5 — 80 < By LZ +0. (6.160) 


For the probability that the observation of |Ҹ;) finds an x € S it follows that 


2 А 
РБ) || = sin? 0j, 
> sin’ (5 + ө) —1- cos? (5 + ө) 
Ye 2 2 
(6.160) 
= jose = 1-2. 
м” N 
(6.149) 


From (6.158) we see that the number jy of GROVER iterations decreases with an 
increase in the number т of solutions. However, at first sight it might seem strange 
that also the lower bound in (6.159) of the probability to find a solution decreases 
with an increase in the number т of possible solutions. The reason for both is that Ө) 
is an increasing function of m and thus an increase in m means that, while we need 
fewer GROVER iterations to reach 6;,,, the possible distance of Ө}, to » increases 
and the lower bound of sin? 0 jy decreases. But for m much smaller than N this latter 
effect is almost negligible. 

To see how the number of GROVER iterations grows with a large and increasing 
cardinality N of the search set, we use that the TAYLOR expansion of arcsin(y) 
around y = 0 is given by 


1) y 2k+1 
2k+17 


(21 — 
arcsin(y) = y+ Y П! ен 
k=1 II- (2j) 


lim ‚Ушем (| )- vn 


which implies that 


and thus 


Consequently, we have 


к=о(үх) for N — оо, 
m 
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that is, the optimal number jy of iterations scales for N — œ with О jz ) : 


N 


In the case where the number т of possible solutions in S is known, the GROVER 
search algorithm to find an x € S in a total set of N — 2" objects consists of the 
following steps. 


GROVER Search Algorithm for Known Number of Solutions 


Input: 


Step 1: 


Step 2: 


Step 3: 


Step 4: 


A set (0,..., N — 1} of N = 2" objects that contains a subset S of m > 1 
objects to be searched for and an oracle-function g : (0,...,N — 1} > 
{0,1} that takes the value 1 in S and the value 0 elsewhere 

In. H”? c HW = Н" c; *H prepare the composite system in the state 
| 46) = |90) & |) with 


|'%) = —— У |0. 


= 
ll 


The number of computational steps required for Step 1 scales for N — оо 
with 
SGroveri (N) € O(1) 


With Ө) = arcsin (V3) apply the transform б = (Ry ® 1)U, 


et 2 Я 
aS 40% 


times to E in order to transform the composite system to the state 
Ej) = GIO). 


The number of computational steps required for Step 2 scales for N — оо 


with 
N 
SGrover2(N) Є o( ) 
m 


Observe the sub-system H//° and infer from the observed state |x) the 
value x € (0,..., N — 1}. The number of computational steps required 
for Step 3 scales for N — оо with 


SGROVER3 (N) E O(1) 


By evaluating g(x), check if x € S. The number of computational steps 
required for Step 4 scales for N — оо with 
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SGrover4 (N) € O(1) 


Output: A solution x € S with probability no less than 1 — 5 


Altogether, the number of computational steps required for one run of the algo- 
rithm, which finds a solution x € S with a probability of at least 1 — 5, satisfies 


4 
М 
SGrover (№) = У Scroveri(N) Є °( x) for N — оо. 


i-l 


We collect these results in the following theorem. 


Theorem 6.30 Let S C (0,...,N — 1} be the solution set with cardinality 
m > 1, and let М = 2" be the number of objects in which we search for solu- 
tions. Let the elements of S be identified with an oracle-function g as given 
in (6.141), and let the corresponding oracle Ü, be as given in (6.142) such that 
g and Ü, require a limited number of computational steps independent of N. 
Then the success-probability of a search in {0,...,N — 1} with the GROVER 
search algorithm to find a solution in S satisfies 


P (The algorithm finds an x € S} > 1 — = À 


The number of computational steps required for the algorithm scales as a 
function of N as 
N 
SGrover(N) € О - for N — ee. (6.161) 


In particular, in the case у < 5 we have for the success-probability 


1 
P {The algorithm finds an x € S} > z 


On the other hand, the case у > 5 does not require any algorithm since a plain 
search of m > i solutions in N objects will yield a solution with probability greater 
than 1. 

Note that he determination of ће optimal number jy of GROVER iterations G 
requires knowledge of N as well as m, in other words, we not only need to know in 
how many objects N we have to search, but also how many solutions m are among 
them. 
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6.9.2 Search Algorithm for Unknown Number of Objects 


There is, however, an extended version [94] of the algorithm that does not require 
prior knowledge of the number m of solutions present among the N objects. We need 
a few intermediate results before we can introduce this version. 


Exercise 6.80 Let J € N and a € R. Show that 


= sin(2Ja) 
2j+1)a) = — 7—-. 6.162 
2,008(( ые) 2sin а ( ) 


For a solution see Solution 6.80 


Lemma 6.31 Let N € N be the number of objects, among which an unknown 
—but non-zero—number m € N of solutions exists, and let Ө) € [0, 5] be such 
that sin? Ө) = p- For a J € № let j be selected randomly from 10,...,J — 1} 
with equal probability I and let EA be the state obtained after j GROVER 


iterations have been applied to 19) as described in Proposition 6.28. Then 
the probability for the event 


ЭСЕ Observation of the input/output reg- 
377 ]ister yields an x € S 


is given as 


1 sin(4J@p) 
Pio -5 AJsin(209) ` (фу 


In particular, in the case J > == we have 


= sin(200) 


P{e3} > =. (6.164) 


Proof The probability of the event ез can be decomposed as 


J-1 ` : A 1/0 
Е j has been Observation of |) in H 
Pita} = УР selected } dl yields a solution x € S 0699) 


Because of the assumed distribution of the j we have 
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jhasbeen| _ 1 
dl selected } (JJ (6:166) 


and using the results of Proposition 6.28, we find 


E . 2 ; 
= sin^0; = sin ((2j4-1)60) 
(6.157) (6.155) 
1 — cos(2(27j + 1)00) 


- А (6.167) 


Observation of |^) in H!/? 
yields a solution x € S 


Inserting (6.166) and (6.167) into (6.165) yields 


P {e3} 


[ 
M 
ч 


211 = 9% 


-— > cos(2(2j + 1)66) 


1 sin(4J@) 
—— 2 4Jsin(20)’ NUN 
(6.162) 


which proves (6.163). 
Ifs> SAO) holds, it follows that 


sin(4J09) € 1 < Jsin(209) 


and thus 
5іп(4700) » 1 
AJ sin(2@)) 7 4' 


which, together with (6.168), implies the claim (6.164). 


In case we know that at least one solution x € 5 Æ 0 exists but do not know the 
cardinality of the solutions set S, the following variant of the GROVER search algo- 
rithm provides a method to find a solution with a probability of at least i As before, 
we assume that (0,...,2" — 1} is the set in which we search and that № = 2” is the 
cardinality of this set. 


Modified GROVER Algorithm for Unknown Cardinality of S 4 0 


Input: A set {0,...,N—1} of N = 2” objects that contains a subset S of m > 0 
objects to be searched for and an oracle-function g : {0,..., N — 1} —^ 
10, 1} that takes the value 1 in S and the value 0 elsewhere 

Step 1: Randomly select an x € (0,..., N — 1} and check if x € S. If it is not a 
solution, go to Step 2. Otherwise, we have already found a solution. The 
number of computational steps required for this scales for N — оо as 
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Step 2: 


Step 3: 


Step 4: 


Step 5: 


Output: 


Sey) € O(1) 


In H”? c HW = H?” c *H prepare the composite system in the state 
|0) = |70) @|—) with 


1 N-1 


6) = Te Db. 


The number of computational steps required for Step 2 scales for N — оо 
as 


о) Є O(1) 


Set J := | VN | + 1 and randomly select an integer j € (0,...,J — 1] with 
equal probability 3 7- Apply j times the GROVER iteration б (Ry ® 


DU g to E to transform the composite system to the state 
(2) = GR). 


Because of j < [VN] , the number of computational steps required for 
Step 3 scales for N — ee as 


(N) e o(vN) 


S ROVER 
Observe the input/output register "IH/ /O and read off the observed x € 


(0,..., N — 1}. The number of computational steps required for Step 4 
scales for N — ee as 


Sosa (M) € O(1) 


Check if x € S by evaluating g(x). The number of computational steps 
required for Step 5 scales for N — oe as 


Se N) € O(1) я 


In case 5 Z 0, a solution x € S with probability no less than 1 


In case at least one solution exists in (0,..., N — 1}, we can formulate the effi- 
ciency and success-probability of the modified algorithm as follows. 


Theorem 6.32 Let N = 2", and let the solution set S С (0,..., N — 1} be non- 
empty. Let the elements of S be identified with the help of an oracle-function g 
as given in (6.141), and let the corresponding oracle be U, as in (6.142) such 
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that g and (oF require a finite number of computational steps independent 
of М. Then the search in {0,...,N — 1) with the modified GROVER search 
algorithm finds a solution with a probability 


de] — 


P {The algorithm finds an x € S) > 


The number of computational steps required for this algorithm scales as a 
function of N as 


(М) є O(N) for N — оо. 


= 
GROVER 


Proof We show the claim about the success-probability first. Let m € N be the 


unknown number of solutions in (0, 1,..., N — 1}. We distinguish two cases: 
ifm ЗМ, the purely random choice of an x € (0,...,N — 1} in Step 1 of ће 


modified algorithm has already a success-probability of at least i > i 
ifl<m< a, we have for 0) with sin? 05 = N > 0 at first 


1 1 1 
sin(209)  2sin@cos@) - 2 sin? (1 ee ө) 


"E NM (6.169) 


24/m(N — т) f 


The case assumption 1 < m < 3 implies 2 < i as well as 1 < ү. From the 
former it follows that 1 — is > » and thus 


1 
CL 08) $4 
(6.169) 


holds. Hence, the number J — [VN] + 1 used in Step 3 of the modified algorithm 
satisfies the assumptions for (6.164) in Lemma 6.31, and the success-probability 
for a run through the Steps 1 to 5 of the algorithm is at least 1 in the case 1 € 
т< av as well. 
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The total number of computational steps required for a run of the modified 
GROVER algorithm satisfies 


5 


S oven UV = UU ) - o(v) for N > ә. 


In the case m 2 1, Theorem 6.32 tells п that the probability of failure in one run 
through the search algorithm is less than 3 т. After s searches it is less than ( 3)" and 
thus after 20 searches already smaller than 0.32%. 

If it is not known if any solution exists at all, that is, if m = 0 is possible, and after 
s searches we have not found a solution, we can only say that with a probability of 
1= (y no solution exists. 


6.10 Further Reading 


A rather comprehensive and up-to-date list of quantum algorithms of all types, 
including adiabatic ones, is maintained online by JORDAN in the Quantum Algo- 
rithm Zoo [95]. Each of the more than 60 entries contains a brief description of the 
algorithm along with extensive references. 

A more detailed albeit more selective overview on algorithms for algebraic prob- 
lems, including the non-abelian hidden subgroup problem, is given by CHILDS and 
VAN DAM [87]. A more condensed version of this can be found in the paper by VAN 
DAM and SASAKI [96]. 

A slightly more comprehensive overview of quantum algorithms, which contains 
nice summaries of each algorithm, is given by MOSCA [88]. 

An accessible and modern introduction to cryptography, covering most of the 
current methods, is given by HOFFSTEIN, PIPHER and SILVERMAN [79]. 

For a treatise on elliptic curves the reader may consult the book by WASHING- 
TON [97]. Details about settings of the elliptic curve digital signature can be found 
online at [93]. 


Chapter 7 A) 
Error Correction ga 


7.1 What Can Go Wrong? 


Already the classical computational process is not free of errors and extensive meth- 
ods and protocols have been developed to detect and correct them. Ideally, these 
methods should enable us to recover the non-erroneous state of the process. We 
introduce the basics of classical error correcting codes in Sect. 7.2. 

As any physical implementation of quantum computation will in most cases be 
based on devices which are very sensitive to disturbances, the possibility of states 
being corrupted by errors is even bigger than in classical computation. Hence, the 
need for error correcting methods without which quantum computation will be 
infeasible. The sources or causes of errors in quantum computation can be divided 
roughly into the following categories [98]. 


Decoherence By far the most common and important cause of errors is that the 
system interacts with its environment in a way that is not in accordance with the 
planned computational process. This can happen if the system is not perfectly 
isolated and will introduce an error in that it changes the state in an uncontrolled 
way. To ensure the integrity of the computation, it is necessary that any such 
errors be corrected and the uncorrupted state be restored as faithfully as possible. 

Coherent Errors We expect gates to perform certain unitary transformations of 
the states. Unlike the transformation of a classical state, which is of binary nature, 
unitary operators form a continuous set. Hence, it is possible that instead of 
performing the desired U, the implementation of the gate actually performs U’ 
which, even though being close to U, is nonetheless different. 

Corrupt Input The initial state of a computation may not have been prepared 
as required. Rather than starting from the desired state |Wini), our preparation 
mechanism may not work with perfect precision, and the state |y.) is prepared 
instead. 
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Leakage In most cases our qubit HILBERT space Н will be a subspace of a larger 
HILBERT space Н, and we assume that once a system is in a state |y) € “Н, all 
our interactions are such that it remains in that subspace "HH, in other words, 
remains a qubit state. For example, our qubit system may be comprised of the 
two lowest energy eigenstates of an atom, and the next higher energy eigenstate 
is at a substantially higher energy level than those two. If none of our interactions 
with the system imparts sufficient energy to make the system transition to the 
higher energy eigenstates, we are effectively dealing with a two state system 
as desired. However, uncontrolled (by us) interactions of the system with the 
environment or insufficient control of our interactions may cause the system to 
transition to a higher energy level state and thus leave the qubit HILBERT space. 
This phenomenon is called leakage. 


To model these errors, we will utilize quantum operations (see Sect. 3.5), that is, we 
assume that any error can be described by a suitable (possibly non-trace-preserving) 
quantum operation. 

However, in order to detect if an error has occurred, we face the obstacle that any 
measurement of a quantum system can change it in an irreversible way as described 
in the Projection Postulate 3. This prevents us from applying a simple measurement 
to find out if an error has corrupted the state. 

A second obstacle particular to quantum systems is that we cannot copy an 
unknown quantum state as the Quantum No-Cloning Theorem 4.11 tells us. In other 
words, we cannot produce multiple copies of our state which we could use to detect 
and correct errors. 

Fortunately, both these obstacles can be overcome by building in suitable redun- 
dancy in our description. This is similar to the classical approach to error correction 
where a single bit is encoded into several bits. We briefly review the basics of clas- 
sical error correction in Sect. 7.2. 

In quantum error correction redundancy will result in representing a single qubit 
by several qubits. This will enable us to perform measurements on this enlarged 
representation to detect potential errors but without obtaining information about the 
state of the original single qubit. It is to be emphasized that building in redundancy 
does not mean duplication and is no violation of the Theorem 4.11. 

Quantum error correction is a large field within quantum computing and it is 
impossible to present all aspects in an introductory text. Nevertheless, the selection 
of topics presented in this chapter should provide the reader with a good understand- 
ing of the basic issues and methods of the field. 

For the group theoretic notions used in this chapter, and in particular for the 
stabilizer formalism, the reader is advised to consult Appendix F in general and 
Sect. E.5 on the PAULI group in particular. 
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7.2 Classical Error Correction 


Here we briefly review how errors are detected and corrected in classical comput- 
ing before we present error detection and correction in the quantum setting in the 
following section. 

The principle means to devise systems allowing for the detection and correction 
of errors is to build in redundancy. In our treatment of classical error correction 
we always work in the binary alphabet consisting of the finite field IF? (see Corol- 
lary E.55). This means that the letters of the alphabet FF? are the by now familiar bit 
values 0 and 1 and that we can perform addition and multiplication on these letters 
in accordance with the rules for the finite field F2, namely, we have for any letters 
a,b € Е in our alphabet 


(7.1) 


As in normal language, letters in Ез can be strung together to form words. 


Definition 7.1 А word of length k € N in Е is defined as the vector 


Wi 
w=]: e. 


Wk 


where F% = [F5 x - - - F2 denotes the vector space over IF? comprised of the 
k-fold cartesian product of the field F. 
The binary sum of two vectors u, v € F% is defined as 


А uj Qv 
u@v= : ENSE (7.2) 


2 
where a © b is as defined in (5.2). 


Hence, words of length К are bit-strings of length k which we can add or multiply 
with 0 or 1. Note that the vector space F% is comprised of a a finite set of vectors. 
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Linear independence in this vector space and its dimension are defined in the usual 
way. 


Definition 7.2 Let k € N and 7 be a finite subset of N. A set of vectors 
{w;| i € I} C F% is said to be linearly independent if for any set {a; | i € I} C 
F2 

У ам: = 0 e» m=O Wel. 


icl 
For any set of vectors {w; | i € Г} C F% the dimension of the linear space 


Span{w; |i € I} = {У awi | aj € Ёз} 
icl 


is defined as the maximal number of linearly independent vectors in this 
space. Any such set of vectors is called a basis in this space. 


Using the usual basis vectors 
: k 
ет= | |,...,6= | e 


we see immediately that they are linearly independent and form a basis in F% such 
that dim F% = k. A word of caution, though: not every set of vectors linearly inde- 
pendent over R is linearly independent over FF? as the following example shows. 


Example 7.3 Consider the vectors 
1 
а= |0],b=|/1],c=]{1 
1 


їп R?. Then any a, b, c € R such that 


a+c 0 
aa+bb+cece= | Б+с | = [0 
a+b 0 


satisfy a = b = с = 0. Hence, a, b, c when viewed as vectors of R°, are linearly 
independent. However, when viewed as elements of ЕЗ we see thatfora=b=c=1 


7.2 Classical Error Correction 347 


we have 


2 
11 


and thus a, b, с are not linearly independent as vectors in F3. 


The vector space F% can be made into a metric space by endowing it with a 
suitable distance function. 


Definition 7.4 A metric space is a set M for which there exists a mapping 
а: Мх M — R satisfying 


(i) 
d(u,v) 20 
(i) 
d(uv)-0 © u-v 
(iii) 
d(u, v) = (у, u) 
(iv) 


d(u,v) € d(u,v) + d(v,w). (7.3) 


The function d is called the distance function of the metric space. 


Exercise 7.81 Let k € N. Show that the function 
dy : FS x FÉ — No 
2 
(uv) — » uj DV; 


satisfies the defining properties of a distance function given in Definition 7.4 and 
makes F% a metric space. 


For a solution see Solution 7.81. 
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Definition 7.5 Let k € N. The distance function 


ан: FE x FS — No 
И 2 (7.4) 
(u,v) — Ули Фу; 


is called the HAMMING distance between the words u and v in the alphabet 
F2. The function 
. pk 
wy : F5 — No (1.5) 
u — dg (u, 0) 


is called the HAMMING weight for words of length k in the alphabet Fo. 


Obviously, 
k 
wg (м) = йн (м, 0) = у uj 
j=l 


is just the number of bits with the value 1 in the bit-string (word) u € Ft. The 
HAMMING distance of two words u and v is equal to the weight of their binary sum 
since 


k 2 k 2 2 
Дн (u, v) = vu 6 vj, =, У (о Ө у); ue d; (u Ф v, 0) 
(7.4) =! (7.2) 7! (7.4) 
2 
Е ф v). 7. 
wg (u © v) (7.6) 
(7.5) 


Altogether, there are 2 words we can write in FS. In order to enable redundancy, 
the words are embedded in a larger space F5 with n > k. This is called encoding the 
words and formally given by a map 


C, : FÉ — Е" 
w — C(w) ` 


Encoding does not mean copying the word but only adding redundancy to it as 
we encode k bits with n > k bits. One straightforward—and perhaps computation- 
ally most efficient—way is a linear encoding which is determined by specifying 
a matrix G € Mat(n x k, F2) such that С, (w) = G w. We want the encoding to be 
injective since otherwise the original word w could no longer be retrieved (decoded) 
uniquely from the encoded word С, (w). The following definition formalizes these 
requirements. 
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Definition 7.6 Let n,k € N with n > К. An injective map 


Ce : Fk — Ft 
w — C,(w) 


is called a classical [л, К code or encoding С, with alphabet Е. The images 
C.(w) are called (classical) codewords. 

If the map С, is linear and specified by a matrix G € Mat(n x k, F2) of 
maximal rank К such that Cc(w) = G w, then the code is called linear and the 
matrix G is called the generator of the code. The distance of the code C, is 
defined as 


dy (Cc) := min { dy (u, v) | u,v € СЕА), о 3 у}. (7.7) 


Note that because of (7.6), the distance of a linear [n, к]. code С, can be given 
in the alternative form 


dg (C.) =, min { wj (u ó v) | u,v € С{Е},и Æ v} 
(7.6) 
= тіп { wy(u)|uc G{F5},u 40}. 


For a linear [n, k]- code with alphabet Е the set of all codewords {G w | w € FS} 
forms a linear subspace 


G(F5) = Span { Gw| we F$} 


of F} of dimension k. Since F3 is of dimension n > k, the elements of G{F% } have 
to satisfy n — k independent linear equations 


YHjGw)-20 №гјЄ {1,...,п– k}. 
l=1 


These equations are called parity check equations. Independence of the equations 
means that the the matrix H € Mat ((n — k) x n, F2) is of maximal rank. 


Definition 7.7 Let G be the generator of a linear |n, К]. code with alphabet 
F2. A matrix H € Mat ((n — k) x n, F2) with the property 
Ker(H) = С{Е%} (7.8) 


is called a parity check matrix of the code. 
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Any vector u € |5 satisfying Hu = 0 is a valid codeword, namely, it is the image 
u = G w of some word w € FÉ. Vectors v € F} for which H v ¥ 0 do not lie in the 
image of the encoding G and are thus corrupted by some error. 

As is to be shown in the following exercise, the parity check matrix is necessarily 
of rank n — k but not unique. 


Exercise 7.82 Let Н be a parity check matrix of a linear [n, k]; code with generator 
G. Show that then 


(i) 
HG=0 
i) 
dim H{F5} =n—k (7.9) 
(iii) H is not unique. 


For a solution see Solution 7.82. 


Note, however, that even though parity check matrices of a code are not unique, it 
follows from (7.8) that their kernels have to coincide. 


Example 7.8 Consider the linear [7, 4]; code with generator 


1001 
0101 
1101 ri 
G-|[0011|2]|: 
1110 г7 
0001 
1010 
To show that rj, . .., r4 are linearly independent let ај, ... ,ад € FF? be such that 
4 
Уату =0, 
j=l 
which is equivalent to 
2 
1 0 1 0 ај к 0 
0| 2 1| 2 1| 2 0 а © 0 
aj 0 Ф a 0 © аз 0 © a4 1 » 0 
1 1 1 1 2 2 2 0 
dj Фа Фаз Ө ад 
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and results in ај = --- = a4 = 0. Hence, G is of maximal rank 4. A parity check 


matrix for this code is given by 


0111011 hi 
H=/O100111]= hi Я 
1001001 hi 
and, as above for rj, ..., r4, it can be verified for h;, hz, һз that they are linearly 


independent. It follows that H is of maximal rank 3. We also have 


1001 
0101 2 2 2 2 2 2 
0111011 1101 191191 1691 1ФІФІФІ 
но = [0100111] [0011 |= | 1&1 1&1 1ó1 ic 
1001001 1110 2 
0001 161 0 161 181 
1010 
0000 
= [0000 
0000 


Finally, the reader may verify in a similar manner that 


" 0011100 
Н = [0100111 
1001001 


also satisfies dim H{F3} =3andHG=0. 


A parity check matrix is a means to detect errors in the encoded words с = Gw 
as follows. Any encoded word с = G w has to satisfy 


He=HGw = 0. (7.10) 
м 
(7.8) 


Suppose the codeword c has been corrupted in transmission or while stored by ап 
error € such that the received or retrieved codeword is 


/ 2 n 
c=cGecF. 


This implies 
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Comparing this with (7.10) shows that He’ Æ 0 indicates that the codeword c' has 
been corrupted, in other words, it is not the image Gw of a word w € Fe This 
motivates the following definition. 


Definition 7.9 Let H be a parity check matrix of a linear [n,k]- code with 
alphabet F2. The map 
=й 
syn, : F5 — F5 
EUER IE (7.11) 
is called a syndrome mapping of the code. The vector H a is called a syn- 
drome of a. 


It follows from (7.11) that uncorrupted codewords c € С{Е} = Ker(H) have 
vanishing syndrome syn,(c) = He = 0, namely that 


Ker(H) — Ker(syn,) . (7.12) 


Exercise 7.83 Show that syn,, as defined in Definition 7.9, satisfies for any a, b € 
FI 
2 2 
syn, (a & b) = syn, (a) & syn, (b) 
such that syn, is a homomorphism, that is, 


syn, Є Hom(F2, F7 ^). 


For a solution see Solution 7.83. 


2 
For c' = c 6 €, where c € G{FS} = Ker(H), we find that 


syn (e) = H(e & е) = H(e) = syn,(e), 


and syn,(c’) = syn,(€) 4 0 tells us that c' has been corrupted by an error. Hence, 
a non-vanishing syndrome is sufficient for error detection. However, in general 
the knowledge of с! or syn, (с!) is not sufficient for unmistakable error correction 
since it does not suffice to uniquely determine ғ and thus the original uncorrupted 
codeword c. This is because 


2 
ѕуп.(а Ф h) = syn,(a) © h€ Ker(H) 


such that the knowledge of syn, (=) only determines the coset (see Definition F.18) 
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[e] = [elken = {€ © h| h € Ker(B)). 


From Lemma F.30 we know that Ker(H) = Ker(syn,) is a normal subgroup of F3, 
and thus the quotient group Е5 / Кег(ѕуп,.) defined in Definition F.23 exists. The syn- 
drome mapping provides an isomorphism between the quotient group Е5 / Кег(ѕуп,.) 
and F2-*, 


Proposition 7.10 For a linear |n, к]. code with parity check matrix Н and 
syndrome syn, the map 


sym, : F2/Ker(H) — Py 
fa] — — syn, (a) 


is an isomorphism. 


Proof From (7.9) we know that H has maximal rank. This implies that for any 
b € ЕЁ there exists an a € Е" such that b = Ha = syn, (а) proving that Fy * = 
зуп„{Ё» }. Since Ker(H) = Ker(syn,), the claim then follows immediately from the 
First Group Isomorphism Theorem E31. 


Proposition 7.10 tells us that there is a bijection between syndromes in put 
and cosets in F5/Ker(H) such that syn, | uniquely identifies a coset from a given 
syndrome. Let c € Ker(H) = G{F4} be a valid codeword sent or stored, and let 


2 
€ = c © € be what has been received or retrieved. Therefore, any potential error € 
satisfies 


2 2 2 
eE=eEGcOc=tGe [& кон) (7.13) 
ccKer(H) 
such that 
duis) = weleqe coat) (7.14) 
He; — H m H . . 
(7.6) (7.13) 


How do we then go about to recover the uncorrupted codeword c from the corrupted 
version €? The codeword known to us is č. From this we can infer syn,(€) and 
thus [@ күну by applying syn '. We also know from (7.13) that € € [€ erg, in 
other words, the error which corrupted c is an element of the coset determined by €. 
Our error correction strategy is then to find the r € [č] Ker(H) with the smallest weight 
and to attempt to recover c by adding r to č. Choosing r € [č] Ker(H) with the smallest 
weight is based on the assumption that in the coset [€] the most likely error which 
corrupted c is the one which changed the least number of bits. From (7.14) we see 
that for a given syndrome this would mean the smallest distance between observed č 
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and the presumed original codeword c. Our classical error detection and correction 
protocol is thus as follows: 


Classical Error Detection and Correction Protocol 


1. Determine syn, (€) = H č by applying the parity check matrix H to ё 
2. Determine [ёну = syn, | ( syn.(&)) 
3. Determine the set of elements in this coset with minimal weight 


Re” [£s = {а € [ кын) | ©н(а)  wa(b) Vb € [ кшн) } 


4. Select a random element | 
rc RES [€] eru) 


2 
5. Calculate č Ф r and proceed with this as the presumed original codeword for c. 


Note that the case where we leave € unchanged is included in this protocol as the 
case where syn,(€) = 0. In this case [C] y, = Ker(H) and ртіп [č] Ker(H) = 40}. 

In general, however, the set А"! [č] Ker(H) May contain more than one element. 
In that case it is not possible to guarantee that the protocol will always recover 
the original codeword c with certainty. This is why this type of recovery method is 
called maximum-likelihood or nearest neighbor decoding. The name originates 
from the assumption that the most likely error is the one that corrupts the fewest 
number of bits. 

However, if the error does not change too many bits relative to the distance of the 
code, then the original codeword can be recovered with certainty as the following 
proposition shows. 


Proposition 7.11 Let C, bea linear |n, К]. code, let c € Ker(H) = G(IF5) be 


2 
a valid codeword sent or stored, and let € = c © € be the received or retrieved 
word corrupted by £. Then c can be correctly recovered from € with certainty 


if 


dg(Cc) — 1 
wa(€) < [sms ; (7.15) 
where |b| denotes the integer part of b € R. 
Proof Let 
Bin (а) = (v € F5 | ан(а,у) € г} (7.16) 


denote the ball of radius r > 0 centered at a in F5. We will show that the intersection 


of all codewords G{F%} with the ball of radius 2 (C) centered at é only contains c. 
To begin with, we have 
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du (C.) 
d = 
née) = wale) <, 75 
(7.14) (7.15) 
such that (7.16) implies 
сє BE (e), (7.17) 


such that 0) < dj (€, a) for any a є G(IF) « {с}, which implies 
ан (C.)/2 x 
a d By СО (©) (7.18) 
for any such a. From (7.17) and (7.18) it follows that 
GLEE} n BEIC" = (e). 


Certain recovery of c from the knowledge of € is then accomplished by finding the 
unique element of G{IFS} in a ball of radius ан (C.)/2 centered at €. 


Proposition 7.11 is often stated by saying that a linear code C, can correct any 
errors € satisfying (7.15). We will obtain similar results for quantum error correction 
to which we turn in the next section. 


7.3 Quantum Error Correction 


7.3.1 Correctable Errors 


Any quantum system is quite easily changed by interactions with its environment, 
and in general it is very difficult to avoid this. In the context of quantum computation 
any such unwanted interaction is likely to introduce errors which need correcting if 
the computation is to succeed. 
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Just as in the classical case, the first ingredient for quantum error correction is 
a means to create redundancy. This is achieved by what is generally described as a 
quantum code. 


Definition 7.12 A quantum error correcting code (QECC) is specified 
with the help of an injective and norm-preserving operator 


Са: H“ 5 HY 


called encoding between HILBERT spaces НХ апа Н“ with dimH* < 
dim H < œ. The space HY is called the quantum encoding space, and the 
image of the encoding 


йа „= (б, E G Y 


is called a quantum code (or quantum code space). The elements of НС are 
called codewords. A convex-linear map 


D, : D(H) > D(H“) 


satisfying 
D, (Са |у) (Wl C) = и) (р Уу) e НЕ 


is called decoding. 
If HA = H®* and Н“ = "IH?" with k < п, then the QECC is called an 
[n, к], QECC and the images 


| == Са |x) e Hf 


of the computational basis states |х) € IH are called basis codewords. 

In the case k = 1 of a single qubit Н“ = “Н, the basis codewords С, |0) 
and С |1) are called logical qubits, and the single qubit-factors "IH 
in Н“ = H®” are referred to as physical qubits. 


We will often use the symbol C, of the encoding operator to denote the QECC. 

Note that just like in the classical case, the code is a subspace НС of dimension 
2* of the larger encoding space IH, which has dimension 2". The redundancy for 
potential error correction is provided by the 2" — 2* extra dimensions in IH". Enlarg- 
ing the original system in this way, means that we are combining it with a system of 
ancillas (see Figs. 7.1 or 7.3 for examples) to a larger composite system. Decoding 
is then accomplished by discarding, that is, tracing out, these ancillas. This is why 
the decoding map has to be formulated on the density operators. 
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Lemma 7.13 Let Cq be an |n, к], QECC. Then the set of its basis codewords 
(9 | x € (0,...,2* — 1}} is an ONB in НС. 


Proof To begin with, note that since Са is by definition injective, it follows 


that |~1) — |@2) # 0 for any |9:); |ф›) € Н“ implies Cq(|91) — |92)) # 0. Hence, 
we have 


Calo) 2 0 le) = 0. (7.19) 


Next, we show that the |.) = C, |х) are linearly independent. For x € {0,...,2* — 


1} let a, € C. Then we have the following chain of implications 


25-1 20-1 0-1 
у ах\Фу)=0 > > ax Са |x) = Cq у axx) | 20 


х=0 х=0 x=0 
25—1 
= у ах|х) = 0 


х=0 


> а=0 \хє{0,...,25—1}, 


where for the last implication we used that the computational basis { |х) } is an ONB 
in НК. This shows that the |Ҹ,) are linearly independent. 

Now, for every |) є Ha = C,{H*} there exists a |p) € H such that |) = 
C, |@). Using again that that the (|x) } form an ONB in Hf, we thus find 


2k—1 201 
Px Са |х) = yy ФҸ), 
=0 х=0 


x= 


258—1 
|Ф) = C4 lp) = Cq | 2 ei) = 


which shows that every |®) є НС can be expressed as a linear combination of the 
n). 
Finally, to show that the |Y.) = C, |x) are orthonormal, we use that by definition 


C, satisfies ||C4 [ф) || = ||ф|| for all |p) € НХ to obtain 
1 2 2 
AIK) = z (ILIO e Po |? = |] 0 — 18) || 
(2.9) 


+ мн) =) ||? н) eit |) 
= (| Calle) + W [P = [| ca – b» IP 


Сах) = ily)) |? -ill c« (9 + ib» ||?) 
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Е АШ +b) IP II x) — b) IP +i Ix) — ily) IP ill lx) + ily) If) 


CL 0D) = by 
(2.9) (3.24) 


Before we consider our first example, we remind the reader that here as through- 
out this book we use all three notations 


бу=1, С = б; = Х, 02 = Oy = » 03—0; = 


for the PAULI matrices/operators. 


Example 7.14 As first examples, we consider two [3, 1]; QECCS in which one log- 
ical qubit is encoded with three physical qubits. The first QECC, which we denote 
by [3, 1];,. is given by the encoding map 


Се : HS 1985 4 ge? (7.20) 
where 
1: H — we 
ly) — |y) & |0) @ |0) 
and 


A=|1)(1] @X @X + |0)(0] 9191. (7.21) 


The circuit for this encoding is given in Fig. 7.1 
For the [3, 1];, basis codewords |), |") € SH®? we thus find 


10) = Са, 10) = A]000) = |000) 


7.22 
\Ф\) = Са, |1) = А|100) = |1) & Х|0) & X|0) = |111), oon) 
Fig. 7.1 Circuit for the K __ N 83 
encoding of the first [3, 1], шп пен 
QECC given іп (7.20) 
ly) | Iw с 
ТЕ 
0 ry 
e 
0) Р 
1 А 
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such that the code is 

НС: = Span{|000), |111)) C HS? , (7.23) 
Note that 


А2 = |1)(1|®Х? gX? + |0)(0|®1®%®1 = |1) (|91914+ |0)(0|®1%®1 


= 1%”. (7.24) 
Hence, the decoding of any 

|) = Ca и) = A(|w) ® |0) ® |0)) = A(|y) 8100) e*H?? (7225) 
can be given as a map on its density matrix by 
A()A* 


D(H?) mae D(*H**) e) D(H) ‚ 
Pin = [PCP] — АР) PAT — |) (и 


Dg, : 


where tr? (-) denotes tracing out the two ancilla qubits introduced by г. This is 
because 


рири) = P (AM)CPIA), = e? (АА (|y) & [00)(y| © (00]) A747) 
(7.25) 
= 2 = 
=, t (ми) (мә |00) (00]), = t (100) (00) |y) (у 
(7.24), (3.36) (3.57) ag 


lw) (yl. 


The decoding circuit is depicted in Fig. 7.2. 


Fig. 7.2 Circuit for the HN = H83 HK =H 
decoding of the first [3, 1], 
ECC given in (7.20 
oo oe e v| lw) 
T 8 
7 0) 
e 
M: 
A tr? (-) 
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The second QECC, which we denote by [3, 1];,. is given by the encoding map 


83 
Саз : H L HL А, 93 F3 He , 


where H denotes the HADAMARD transformation defined in Definition 2.38. It has 
the property 


|0) +11) |0) — |1) 
НО =, — =—=]+) and All) =, — ——e=\|-). 7.26 
|0) =, J |+) 1) =, Ji =) (7.26) 
(2.160) (2.161) 
For the [3, 1], basis codewords |®p), |®;) € “HS? we thus find 
3 3 
|Ф)) = Са, |0) = H®*A|000) = Н®°|000) =| + ++) 
(7.22) (7.26) (7.27) 
_ _ 783 — 783 [йз 
|®,) = Са, |1) = H^" A|100). = Н°-|111) = || ) 
(7.22) (7.26) 
such that the code is 
Hea = Span(| + ++), |- ——)) c H®. (7.28) 


To illustrate the point that the encoding creates redundancy and not duplication, 
we consider the [3, 1];, code of Example 7.14. There we have 


Ca; (410) + b|1)), — ,а1000) + b|111) # (al0) + 61)“, 
(722) 


where the state to the right of the inequality shows what a three-fold copy of the ini- 
tial state would look like. Hence, a quantum encoding does not constitute a violation 
of the Quantum No-Cloning Theorem 4.11. 

Another code with more redundancy than those of Example 7.14 is due to 
SHOR [99]. It requires nine physical qubits to encode one logical qubit. As we will 
show later, it corrects all one-qubit errors. 


Example 7.15 In SHOR's nine qubit [9, 1]; QECC, which we denote by Cq,, one 
qubit is encoded with a logical qubit consisting of a tensor product state of nine 
(physical) qubits. The encoding map is given by 


Са : HS H? 5 H, (7.29) 
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Fig. 7.3 Circuit for the ШК = H HN = H29 
encoding of SHOR's [9, 1], 
QECC given in (7.29) as 
Cas = АзАзАн Lv) WM и lu 
e 
0) 
e 
0) 
e 
© Х Н 
@ 
0) 
@ 
0) 
@ 
o X H 
@ 
0) 
@ 
0) 
1 Aj Аз Аз 
Cas 
where - 
i: H — H | (7.30) 
ly) — ly) & |0) 
and А = A3A2A with 
A; = |1)(1| 8 1? @X @ 1°? @X e 19? + |0)(0| @ 188 
А = (Н @ 192)? (7.31) 


Аз = (|1)(1] e X & X + |0) (0| @ 192)? 


and, as usual X = оу, and H denotes the HADAMARD operator given in Defini- 
tion 2.38. The circuit for this encoding is given in Fig. 7.3. 


Exercise 7.84 Show that 


Са; (а|0) + Ь|1)) =a ( A 


3 
poo" +0 (0% 


— |111 
V2 


) 83 
) . (7.32) 
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For a solution see Solution 7.84. 


It follows from (7.32) that the basis codewords are 


83 
M) = Caso) = (OE) 


(7.33) 
I = Cas |1) = (cin 
1 qs 3 E 
and the code is given by 
93 93 
HOs — рай = + 2) | (™ — 2) cHe. 
v2 v2 
Exercise 7.85 Show that the A; for i € {1,2,3} defined in (7.31) satisfy 
A? = 18°, (7.34) 
For a solution see Solution 7.85. 
The statement (7.34) of Exercise 7.85 implies that 
A1424343A2A, = 1°? (7.35) 
and thus 
— _ _ 8 
AjA2A3 Сас |W) — „АтА2АЗАЗА?А i] y), = iy), = |W) & |0)”. 


(7.29) (7.35) (7.30) 
The decoding Dg, : D(*H*?) — D(H) is then given by 
Dgs(p) = ti? (A145A3pAsAoA1) , 


where we have made use of the fact that А? = A; for i € {1,2,3}. The circuit for 
this decoding is shown in Fig. 7.4. 


Each basis codeword |.) є НС is the image of a unique un-encoded word 
|x) Є Н“, which can be recovered by the decoding Dg. Generally, the more redun- 
dancy the encoding provides, the more errors will be detectable. On the other hand, 
the more redundancy is encoded, the more computational resources are required. 

We wish to create a mechanism by which errors corrupting the codewords can be 
corrected. In doing so, we need to specify which type of errors we consider acting 
in НС and how we can construct recovery mechanisms for these errors. 
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Fig. 7.4 Circuit for the HY = H2? HK =H 
decoding of SHOR's [9, 1], 
= ) и) 


X 
X 
? e H X 
X 
X 
A3 A2 А\ 1) 


Of course, ће encoding Cq and ће decoding Dq themselves could be prone to 
error, that is, the methods to correct errors can suffer from errors. The treatment 
of such combined errors belongs to the realm of fault tolerant quantum computa- 
tion [100, 101], which we will not address here. In our discussion we will only 
consider errors corrupting (encoded) codewords, in other words, we assume errors 
occur after encoding and before decoding. This is illustrated in Fig. 7.5 with the 
[3, 1]4, code of Example 7.14. 

The situation we are trying to describe by modeling the occurrence of errors in 
quantum systems is then as follows. We first consider the case of pure states in the 
code space Hs and then the case of mixed states in D(H“). Let us assume our 
system is initially in the uncorrupted pure state |^) € Hea c Н“. We then need to 
specify which possible errors may occur. We do this by specifying so-called error 
operators êz € цн” ) where a € / C No and / is a set indexing the errors covered 
by our error model. The original uncorrupted states are in IHC«, but the effect of an 
error will in general take them out of the code space. Therefore, the error operators 
are elements of ЦН” ). 

If the error indexed by a occurs, then the system ends up іп a state &,|w) c H. 
Since this is a random event, we need to assign it a probability of occurring, which 
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HK = H HN = He? Н“ =1Н®3 HK = Н 
ly) |у) ^ em ПОД v) 

© T Error | = 

|0) X E detection X 0) 

e ge rror and Q 

10) X correction x |0) 

1 А А tr? (.) 

Encoding Decoding 


Fig.7.5 Illustrating our assumption of error occurrence between en- and decoding for the [3, 1], 
code 


we denote by pa. We also allow for the possibility of no error by always including 
the 'error' operator ĉo = 1 and by specifying the probability of no error with po. 
After the error is assumed to have occurred, our computational state is given by a 
statistical ensemble of states &,|w) each of which occurs with a probability p,. As 
discussed after the proof of Theorem 2.24, such a system is described by the mixed 
state 


€(pw) = У, pakal¥)(Ea| — > p.e, |) (6164 


aci (2.33) acl 
= У paĉaprê = У Ea py E`, (7.36) 
aci aci 


where we set Ea = Ра E. in the last equation. 

The very same arguments apply if our original uncorrupted system is in a truly 
mixed state p € D(H“). In this case each error a produces a new mixed state 
ёар E with probability p,. The resulting statistical ensemble of mixed state is 
described as in (7.36) with py replaced by p. 

From Definition 3.26 and Theorem 3.24 we know that any quantum operation K 
can be expressed in terms of its operation elements (ака KRAUS operators) Ka by 


K(p) = У KapK; , 


which is precisely of the form (7.36). Moreover, most errors are caused by interac- 
tions of H with the environment, and quantum operations have an environmental 
representation reflecting this. These considerations lead us to model the effect of 
errors occurring in a system IH" with the help of a quantum operation (see Sect. 3.5) 


€ : D(H”) — D«(H") 


p ++ E(P) = Laer Ea P EG’ 8 
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where the operation elements С, are of the form €, = ,/ раба and satisfy 


Se Ea < к1 (7.38) 


acl 


for some к €]0, 1]. From Corollary 3.25 we know that equality in (7.38) is equiv- 
alent to tr(£(p)) = к for all p € D(H). For reasons which will become obvi- 
ous once we have introduced recovery operations correcting errors, we will have to 
restrict quantum operations classified as errors to this category of constant trace. 

While the quantum operation € in (7.37) is defined on all of Н“, we are only 
interested in the effect of € on p € D(H“). However, since Ha C HIN there is a 
natural embedding D(H“) — D(HY ) given as follows. From Theorem 2.24 we 
know that for any p € D(H“) there exists ап ONB {|Ө;)} in Н and q; € [0, 1] 
with У; qj = 1 such that 


P = Y.40)9. (7.39) 
J 


Any ONB іп IHC« c IH can be extended to an ONB in Н“ and thus р in (7.39) can 
be viewed as an element of D(H” ). 

We finally arrive at the following definition of an error operation and related 
notions. 


Definition 7.16 Let IH be the encoding space of a QECC with code НС“. 
An error operation in the code НС is defined as a quantum operation 


DE ул (7.40) 
р +> Laer ёар €; 
with operation elements Ea € ЦІН”), where a € J and J is some index set. 
An error operation in an [л, k], QECC is called an m-qubit error operation 
if all its operation elements are m-local (see Definition 3.21). 
To model a set of errors indexed by a € Г which change the states by acting 
with ĉa € ЦН”) and which occur with probabilities pa € [0, 1], we choose 
operation elements in the form 


where the pa satisfy У „сг Pa = 1. The operators СЕ цн“ ) are called error 
operators. They include the ‘no error’ operator êp — 1. 


We will often write € = {€,} to denote the error operation and its operation 
elements at the same time. Just as we saw in Corollary 3.27 that the operation 
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elements for a given quantum operation are not unique, the operation elements for a 
given error operation are not unique either as is to be re-confirmed in the following 
exercise. 


Exercise 7.86 Let € = {€,} be an error operation, U € U(m) a unitary m x m 
matrix with matrix elements U,, and 


m 


fe Yah Si: (7.41) 
b=1 


Show that then ё = {ča} generates the same error operation, that is, 
E(p) = У epe = У Enp & = E(p) Vp e D(H") 
a b 


and 


For a solution see Solution 7.86. 


To illustrate the naming convention used in connection with certain error opera- 
tors, let us consider for a moment the case of a single qubit-space ‘H only by assum- 
ing п = 1. In H consider an error operation € with the error operators ёа = са and 
the following operation elements 


Ea = раба, = VPa0y = Eg fora Є {0,...,3}, (7.42) 
(2.74) 


where we require pq > 0. Then we find 


It follows from Corollary 3.25 that 


Ура=1 © tr(E(p))=1 Vp € D(H). 


The error operation € generated by these error operators transforms the density oper- 
ator of a pure state py = |y} (y| € D(H) to the corrupted density operator 
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3 3 
E(py) = У, Ea Py EG =, У, Paoa|v)(vlos - 
a=0 кул = 


Therefore, the error operation { Ea = J/PaOa | œ € {0,..., 3H leaves the state 
|y) unchanged (no error) with probability po and transforms the state |y) to a cor- 
rupted state 0;|y) for j Є {1,2,3} with respective probabilities р}. 

Due to their action on single qubits, the error operators су for j Є {1,2,3} have 
been given the following intuitive names. 


The bit-flip error X = o; ‘flips’ the qubits since it acts as 
X(a|0) + b|1)) = а|1) + 00) 

The phase-flip error Z = o; changes the phase since it acts as 
Z(a|0) + b|1)) = а|0) — 51) 


The bit-phase-flip error Y = o, flips the qubits and changes their phase since it 
acts as 
Y(a|0) + b|1)) = i(a|1) — b[0)) i 


Returning to the general case of HY = "IH?" with n > 1, a one-qubit error opera- 
tion € affecting only qubits in the factor space ‘HI; can be comprised of the error 
operators 


^ 


£o = 24 = 19717 @ са 9 19] fora € {0,...,z}. (7.43) 


Here we use the observable xi introduced in Definition 5.35, where 
j denotes the j-th qubit counted from the right starting with j = 0 and о € 
{0,...,z} with oo = 1. This counting convention is chosen to remain consistent 
with our previous counting convention (3.18) introduced in Definition 3.5 of the 
computational basis, where it was adapted to mimic the binary representation of 
natural numbers. 

One-qubit error operations of the form 


é= { Era.) 2/791 ae {0,...,}}, 
transform a state 


IP)-]w)89--G|wii)? [wj Bly) 6--- 9 wo) 


to states 


ELIP) = |Wn-1) @ +++ 8 |у) Caly) 9|vj-1) €--- & |wo) 


with respective probabilities ро. Error operators of the form 


А 


— yj j 
Elaji), lanji) = хд T ‚>й 
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describe /-qubit error operations. They affect up to / qubits when they occur with 
a probability p(o,.j,).....(o,,j. An example of a 2 qubit-error operation is given by 
error operators of the form 


К "TP des We" : 
Elo, ji): (ој) = Ха Хоф = 18-12 8 Обо, ® poa бо ® 1r, 

where we have assumed jı < j2 in displaying the rightmost equation. These error 
operators have non-trivial action with probability p in at most two of the 


factor spaces 19; and "Н, if o 5 0 # oo. 


05,1). (00.2) 


Example 7.17 Consider the two QECCs [3, 1];, and [3, 1]; from Example 7.14. 
The [3, 1];, code has the code space 


НЇ!Ї = Span{|000), |111)} = $рап{|%), |¥1)} . 
(7.23) 


The one-qubit bit-flip error operation €" = { Erf | s,t € {0, n is generated by 
the error operators 


êt -18181 êt = 1891890 
& -180691  éf—o 9191. 


(7.44) 


Recalling that 0,|0) = |1) and о,|1) = |0), we see that these errors transform the 
[3, 1]4, -basis codewords as follows 


oilo) = ©1000) = |001) ёч) = e) = |110) 
10/16) = 2151000) = |010) ё) = Ci) = |1010) (745) 
ёз |) = EP} |000) = |100) ёч) = e) = |011). 


The one-qubit phase-flip error operation £P! = { Erf | s,t € {0, 1}} is given by the 
error operators 
êf =19191 ê =1®1®о, 


ks: (7.46) 
© 718 0;&1 © = 6: 8161. 
Using that о: |0) = |0) апа с; |1) = —|1), we see that their action on the [3, 1];,- 
basis codewords is quite simple 
Ёру) = 2011000) = |000) = |Ҹ 
|) = 291000) = [000) = 0) uS 


e) = 0p = —[111) = —|%). 


The [3, 1]4, code has the code space 


7.3 Quantum Error Correction 369 


13:10 = Span{| + ++), |= ——)} = Span{|®o), |Фу)}. 
(728) 


In the [3, 1];, code the situation between bit-flip 69 and phase-flip £P! is reversed, 
that is, we have 


ё Bo) = EF + ++) = | + ++) = |Фу) 


А n (7.48) 
e| i) = ён == ) = —|Ф)) 
but 
apf apf apf apf 
бф) = eult ++) = |+) — 8890 = 68-2 =1– +) 
apf apf apf apf 
Et | Po) = a +++у=[+=+) Ef o| P1) = a ===) = |=) 
apf apf apf apf 
£d) = el +++) =|—++) ene: = enl – –—) = |+ Е. 49) 
Two qubit-flips are generated by error operators of the form 
e = xx 
and we have, for example, 
СЗ) = 23101000) = |101). (7.50) 


Now that we have defined the type of possible errors we will consider in our 
theory of error correction, we need to identify means to rectify them. We begin this 
by defining the recovery or correction operation. 


Definition 7.18 Let H be the encoding space of a QECC with code IHC« 
and £ an error operation in the code Hs. A recovery operation is a trace- 
preserving quantum operation 


R: D(H’) — D(H) 
р —XRpRD 


The operation elements R, € ЦІН“) are called recovery operators. A recov- 
ery operation R is said to recover or correct an error operation € іп IHC« 
if 

E(p) 


коош Cy 
de: p VpeD(He). (7.51) 


An error operation € in the code НС is said to be correctable if a recovery 
operation for it exists. 
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Just like for the error operation, we will often write R = {R,} to denote the 
recovery operation and its recovery operators at the same time. 

The condition (7.51) for an error operation ё to be corrected by a recovery oper- 
ation R is quite intuitive. It states that any state p € Hs in the code which is cor- 
rupted by € is recovered by К. It also gives a first condition for an error to be 
correctable as the next lemma shows. 


Lemma 7.19 For an error operation € in the code НС of a QECC to be 
correctable it is necessary that it satisfies 


tr(E(p)) = const = ке є [0,1] Vp € D(H). 


Proof The claim follows from the result in the following exercise. 


Exercise 7.87 Let H be a HILBERT space and S and T quantum operations on 
D(H). Show that then 


T (Ер) =p Үрєр(Н) = tr(S(p)-—cons Vp € D(H). 


For a solution see Solution 7.87. 


As it stands, however, (7.51) is not so useful in determining if an error operation 
€ is recovered by R since we have to check it for all p. Fortunately, there exist 
equivalent conditions for an error operation to be correctable that can be stated in 
terms of the error and recovery operators. 

The first such characterization given in Theorem 7.20 is in the form of necessary 
and sufficient conditions which the operation elements €, of an error operation € 
and recovery operators R, have to satisfy for R to correct €. The second formulation 
given in Theorem 7.22 states such necessary and sufficient conditions in terms of 
the operation elements €, and the code alone. 


Theorem 7.20 Let € = (€, | a € {1,...,1}} C UHN) be an error oper- 
ation in the code НС of a QECC, and let R = { В, | r € (1... mj © 
цн” ) be a recovery operation. Then the following equivalence holds. 
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37 € Мат x1,C) such that 


The error operation 
R,cR : 
E = (£4) in НС | TR 


is correctable by R (в e-z D —0 
r Ca та fg — M5 


and, if these statements are true, we also have 


tr(Z*Z) =tr(E(p)) Vp € D(H). (7.52) 


Proof To prove =, let € be correctable. Then we know from Lemma 7.19 that 
tr(E(p)) = Ke Yp € D(H). (7.53) 


Since R is by definition trace-preserving, that is, tr(R(p)) = 1 for all p, Corol- 
lary 3.25 implies that 


XU5-1-ENR. (7.54) 


Moreover, using the fact that © and К are quantum operations with operator-sum 
representations, we have for any p € D(H“) 


PUR URS К; Ke ыл ыз. 
(7.51) (3.97) (3.97) 
such that 


кер = кыре Vp € D(H). 


For p = |W)(¥| with |P) € НС such that ||\Р|| = 1 this becomes 


Kg| P) (P| = È R, Ea |P) (P| E; Rz, — УК Ea |9) (PIR, Ea)” (1.55) 


ra oe ra 
such that 
Ke — ке | — ke CPP) (|) = (PIR, Ea PPR, £5)" P) 
EET (1855) ^^ 
= » UR. Ea V) (R, Ea P|V) 
in uli 


(2.30),(2.31) 


=, vU RA (7.56) 
м T 
2.1) 
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Exercise 7.88 Show that for any HILBERT space H, operator A € В(Н) and vector 
|y) € H with ||v]|| = 1 one has 


Па — (ИТА) lv) || = tviA*Av) — I(viAv)? . (7.57) 


For a solution see Solution 7.88. 


Using the result of Exercise 7.88 in our case for Н = Hs, the operator A = R, Ea 
and the vector |y) = |) € НС we obtain 


2 _ * m 2 
|А, Ea = (PIR, Ea w)) [P^]. = AFIR, Ea)" Ry Ea P) — (P | К, Ea ¥)| 


(7.57) 
= ДРЕ ЕВ, Ea?) — (PIR Ea P) 
oe 
such that 
2 х рх 
У ||(R; Ea (|А, Ea P) P) = L(P| E; RT Ry Ea ¥) — = нү 
= БУГЫН XR R; ) £a Y) — ке 
TO 
= 0. 
Ww 
(7.54) 


As the left side is a sum of non-negative terms, this can only be true if each term 
vanishes, and it follows that for every R, € R, €; € € and |) € H with |[Р|| = 1 
we have 

К, Ea |P) = (P| R, Ea P))|¥) . (7.58) 


Exercise 7.89 Let H be a HILBERT space and A € B(H). Show that then 


Aly) = (wlAy)lw) YY ES € EC: A-al, 
where Sh denotes the unit sphere (vectors of norm 1) in H. 


For a solution see Solution 7.89. 


Using (7.58), we see that the statement in Exercise 7.89 then implies for A = К, Ea 
that for each R, € R and €, € ё there exists a Z4, € C such that for all |W) € Hea 
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R; Ea |P) = Za4| v). (7.59) 
Therefore, we have 


2 2 EN 2 __ 2 __ 
PII =, IIa IP = IIR Ea |) = (Ry Ea IR, Ea Y) 
(2.7) (7.59) (2.5) 
= (P|ESRËR, Ea Y), (1.60) 
(2.31),(2.30) 


and in summing over r and a, we obtain for any |^) 4 0 


m 1 
Zra = 
PSA ra 


г=1 а=1 


py e Y RAR, Ea Y) = Ke. (7.61) 
(Ys кыы, 


(7.54) 


On the other hand, we have 


tr (ZZ) =! VA Z) )аа dor Zra = Mua = = Хх, (Zra? =, 


(2.57) а na 0 һа һа 


St (E(P)) 
(7.53) 


(7. am 


for all p € D(H*3), which completes the proof of — and the claim (7.52). 
To show <=, let each R, € К and €, € € be such that there exists a Z,a Є C so 
that for all |) € IHC« 
R; Eq |V) = Za4| v). (7.62) 


Then it follows that for any |) є Hs 


(P| EZR} = (Ф|(К, Ea) 
(2.47) 


(К, Eq Ф| — (Zi. 4| ==; Жа\Ф|. 


2 
(2.3 (7.62) (2.33),(2.32) 


(7.63) 


Since R is by definition trace-preserving, Corollary 3.25 implies that У, В R, = 1 
and thus 


Y aa (Ф|У) = (Ф| p» e (XR; R, ) Ea V) DN Ф| >, ёа €, V). 
18 (7.62),(7.63) е Í (2.47) 


As this holds for any |), |") € Hs, it follows that Y, £7 Ea = (X4 |Zral? )1, and 
Corollary 3.25 implies that then 
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tr(E(p)) = (124) Vp € D(H“). (7.64) 


Now, let p € D(H“). Then we know from Theorem 2.24 that there exist p; € [0, 1] 
with У, ; ру = 1 and an ONB {|Ө;)} in H“% such that 


р -XYrilej)ej. (7.65) 
J 


Therefore, we have 


Elp) - X Epl... 1 m 
ЧС) ~ LR tr (£(p)) ve (ép 2 PEN 


У pj Rr Ea |j) (;] EG R} 


na,j 


1 
~~ rE) 


(7.65) 
1 vi 2rd | 
= У р; |22 ONO; = = р/Ә;)(Ө; 
\ " tr (£(p)) x i | a | i) { Д tr(£(p)) >, jl j) Д 
(7.62),(7.63) А 4 
=, р, 
(7.64),(7.65) 


and © is correctable. 

An almost direct consequence of Theorem 7.20 is that if ё = {Ea } is correctable 
by R, then the error operation generated by any linear combination of the С, is also 
correctable by R. 


Corollary 7.21 Let£ = { 2. |a € {1,...,J}} and č = (E, | se {1,...,t}} 
be two error operations in the code НС of a QECC which are both cor- 

rectable by R = {R, | r € {1,...,m}}. Furthermore, let V € Mat(v x 1, C) 

and W € Mat(v x t,C), and let € = ( £, | u € {1,...,v}} be the error 
operation in НС given by operation elements 


1 
Ej V VUES У И... (7.66) 


Then € is also correctable by R. 


Proof From Theorem 7.20 we know that, since € and č are correctable by R, there 
exist 2 € Мат x I, C) and Z € Mat(m x t, C) such that for any R,, Êa, Čs and 
|) є HG 

R,&j|w) —2,|V) and Б, |У) —Z,|w). (7.67) 
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Therefore, we have for every R, € R, 2, € € and |У) € На 


К, ё, \Р) == X Vau R, Sau T S Wou К, E, |") 
5 


а 


(7.66) 

= Y Vau?) + У.) = (2v + Zw), e) 
(7.67) © i 

m Zrul P) , 


and it follows from Theorem 7.20 that € is correctable by R. 


Note that since we would like € to be an error operation, the matrices V and W in 
(7.66) cannot be completely arbitrary as we still want to ensure that tr(£(p)) < 1. 
As long as this is assured, however, any linear combination of operation elements 
generates an error operation which remains correctable by R. 

The result of Theorem 7.20 allows us to determine from the error and recovery 
operators if the error operation is correctable. However, it suffers from the shortcom- 
ing that we need to know the recovery operators R, in order to determine whether 
€ is correctable. The next theorem alleviates this in that it provides necessary and 
sufficient conditions for an error operation € іп НС to be correctable, where the 
conditions are given in terms of its operation elements €, and the code Hs, 


Theorem 7.22 Let = ( Ea | a € (1,...,1)) € HY) be an error opera- 
tion in the code НС of an [n, К]. QECC, and let ИЕ | we {0,...,2*— 
1}} be the ONB of basis codewords in HC. Then the following equivalence 
holds. 


3C € Mat(I x І, С) such that C* = С and 


© = {Ea} nies V Ea, y € È and |), |) € {\Ч)}: 


The error operation 
< 
is correctable 


(С V. Ep HS = уйу Й (7.68) 
and, if these statements are true, we also have 


tr(C) =tr(E(p)) Vp e D(H). 


Proof To prove =, let © be correctable. Then there exists a recovery operation 
R= { R, € цн“ ) | r € {1,... m). which is a trace-preserving quantum opera- 
tion satisfying 


3 RR, =1 (7.69) 
r=1 


and which corrects €. Theorem 7.20 implies that there exist Z,, € C satisfying 
(7.52) such that for all |) є Ha 
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R; Ea |У) = Zral P) . (7.70) 


Hence, we have for any basis codewords |Ҹ,), |Ҹ,) € НС 


(Ea BEB) =, (Ea (Уу RR, ) £j %) = Y (Ea [RE R, Ep 5) 
7.69) r=1 r=1 
- AR Ea Y| R, Ep р) = È (Zat, | ь\Р,) 
(2.30),(2.31) ^ — (7.70) — 


m 
У, raZrb (ҸҸ) = Сльбуу, 
= —— 

(2.6) " =бу 


where in the last equation we used Lemma 7.13, and where Cap = Y, ZraZrp is such 
that 


Moreover, we obtain 


= >) Caa = = y Y uz = y > |2 m zt (E(p )) . (7.71) 


ү a-lr- a=] r= c 


To prove <=, let 
(Ea Ф| £5 P) = Cav dry ; (7.72) 


where C € Mat(/ x I, C). Then it follows for any |.) that 


cS Cha — , = (26| Ea) = (Ea | En) — Са. 
Gu m (2.1) (772) 


Since C is self-adjoint, it can be diagonalized by а unitary / x / matrix U such that 
1 
= ОаьСьсОса = Сабаа , (7.73) 
b,c=1 


where the C4 are the eigenvalues of the matrix C. With the matrix U we define the 
operators 


2 1 
Ea = » Uba Ep € ЩН“), (7.74) 
b=1 


7.3 Quantum Error Correction 3T] 


and from Corollary 3.27 we know that the operators {Ea} generate the same quan- 
tum operation as the {E4}, that is, we have 


E(p) = &(р) Vp € D(H’). (7.75) 
Moreover, we find 


CMY: =, (S Ual KY Um Ea B) = ~ wap (Ec Yel Ea Чу) 


(7.74) d (2.4),(2.6) 4 
RUP > Uj Cea Uap Sxy == Сабаьдуу Д (7.76) 
(7.72),(2.34) %4 (7.73) 


апа we can conclude that 


C, - (£ [E E.) > 0. 


(7.76) (2.2) 


Also note that since the trace does not depend on the basis (see Exercise 2.16), we 
have 


У, Ca = tr(C)_ = wep): (7.77) 
a=1 (7.71) 
We divide the index set T = {1,...,/} indexing the operation elements Ea into two 
sets 
b= {a€T|Ca=0} and Љ = {ає |С, > 0}. (7.78) 


ы 2 
For a € Io we have for any basis codeword |Y) € Hs that | б = C, = 0 and 


thus 


Edu =O Yach. (7.79) 


| HC 


For every a € I~ and basis codeword |.) € НС we define a vector 


am 
| Pax) = Варе. (7.80) 
Са 
The |Ф, х) є НС с Н“ satisfy 
1 o = Слбаьдуу 
Pax Dh) = €g We, M, = — = буу. 7.81 
( a, | by) OG A b ^). А CG аһ ху ( ) 


(7.80) (7.76) 
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Hence, they form a set of orthonormal vectors in Н” and we can extend them to an 
ONB of НУ, namely, we can find |) € Н“ such that {Ф у), |5) } form an ONB 
in H satisfying in addition to (7.81) 

(Da |5) = 0 and (Ej|E;) = dps. (7.82) 


With the |®, x) and | Ж) we define recovery operators Ко, Ra € цн” ) аѕ 


Ry = У 8E and Vach: Rg = IR 9, |, (7.83) 
p 
such that 

R = ¥(|2,)(2,|)*. =. ¥.|2,)(Z>| =R 

0 ХИ pp. 2» p) (Ep| = Ro 
(2.36) (7:84) 

R; = EX Bal)“ = ХФ.) 
(2.36) 


and thus 


RjRo Y RR, =, УЕ) (845)(54- Y, D Da) (HIB) (Pay 
acr. (7.83),(7.84 у P5 М acr. х,у = 
.83), =6ps =буу 


= КИЕ =] sp у У 1Ф,,)( Ф, | 
р acl, х 


= 18“ 


ѕіпсе (19... |= ру} is an ONB іп Н“. Corollary 3.25 then implies that the Ro and 
R, can be taken as operation elements to construct a trace-preserving quantum oper- 
ation R. It remains to show that this operation corrects €. Since {|Ч„)} forms an 
ONB of the basis codewords in Hs, we can write any p € D(H“) in the form 


p = X es 08. (7.85) 
х,у 


such that 


if a € Ig 


~ ~* ~ ~x 0 
Eao E = Y p, Eo A) GE E, | 
рё = D ps e EOS PR ifa c I, 


(7.79),(7.80) 


and thus 


Elp) = El Spee ye a 2 Pryl Pax) (0, - 
(1.15) (1.40) ає xy 
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With this we find 


Ro E(P nr b» Y Caps») (ЕФ, х) (Pa ,|5;) (Esl 


rod х,у 


= 0 (7.86) 
м 
(7.82) 


as well as 


E REOR =, X Y Y Уру) (ФФ) (ФФ) 


bel, (7.83),(7.84) bel, x' y! ає1> х,у 
SY OXEOeQUQ. = ,( У, Cale cor 
(7.81) acl. x,y (7. md acr. ms 78) а= 
= Ч(ё(р))р. (7.87) 
(7.73) 


Setting Z = {0} UAL, we thus have created a recovery operation R = {Rg | a € I} 
that satisfies for any p € D(H“) 


E(p) Е E(p) y. 1 r 
B (sies SS 2, Re c(e(pjj Ка = [руу 2 Ra 0) Re 
= Р. 


(7.86),(7.87) 


and the К we have constructed corrects €. 


With Theorem 7.22 we can determine if an error operation € = (£4) in a code 
НС is correctable. This determination can be made with information from the oper- 
ation elements €, and the codeword basis { |.) ) alone. To give a rationale for the 
condition (7.68), it is worthwhile to consider the equivalent operation elements Ea 
constructed in the proof from the matrix diagonalizing C. The Ea generate the same 
error operation € as the £,. If a € Jp, then we have £a [nies = 0. If a € F, then the 


РАГА give rise to orthonormal basis vectors |Ф, x) € Н“, and we have 
(££, B) = Ca Sab Oxy . 


This states that the operation elements ё, generating © map orthogonal codewords 
|.) to orthogonal subspaces (spanned by the |®, ,)). This means that after different 
elements es £ &, have acted on any pair of codewords, the probability to observe 
&,|‘%,) when the system is in the state ELE) is zero if a Æ b or x Z y. If this were 
not the case, it would be impossible to uniquely recover any codeword after an error 
has occurred. Therefore, the condition (7.68) guarantees that after © has corrupted 
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any codeword, the corrupted state is sufficiently ‘distant’ from any other corrupted 
state so that we can recover the uncorrupted codeword uniquely. 

Another important feature of the condition (7.68) is that the matrix C does not 
depend on the basis vectors |.) of the code, namely, it implies 


(Eq V. Ep P) = Cab VIE) € (uy, (7.88) 


where Cap does not depend on x. If Сар were to depend on x, it would reveal informa- 
tion about the codeword |). This is akin to observing |) and if the encoded states 
are part of an entangled state, any such entanglement would be destroyed rendering 
the computational process useless. 


Example 7.23 Consider the two QECCs [3, 1];, and [3, 1]; from Examples 7.14 
and 7.17. The basis codewords in the [3, ll code were determined in (7.22) to be 


|o) = 1000) and |Ҹ) = |111) 
and those for the [3, 1]; code were determined in (7.27) as 
|) =|+++) and |Фу=|——-—). 


We find for the bit-flip error operators B and phase-flip operators ep in the [3, 1];, 
code that 
(ёё) =, Cy 
i м 


Іт st,lm 


9, (7.89) 
(7.44),(7.45) 
(ёр р) =, (ёнёр). (7.90) 


—— 
(7.46),(7.47) 


From (7.89) we see that the bit-flip error operation £f satisfies condition (7.68) in 
Theorem 7.22 in the code [3, 1],, and is thus correctable in this code. On the other 
hand, (7.90) shows that the phase-flip error operation ЄРЇ does not satisfy (7.68) 
in the code [3, 1],, because it violates (7.88). Therefore, phase-flip errors are not 
correctable in this code. 

Likewise, we find in the [3, 1],, code that 


(Maga = Ow (7.91) 


st, Im 
(7.46),(7.49) 
(ё®Ф|ё Фо) =, — (E8185, Ф). (7.92) 


(7.44),(7.48) 
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Here the situation is reversed, and (7.91) shows that the phase-flip operation Er js 
correctable in the [3, 1]; code, whereas (7.92) shows that the bit-flip operation g 
is not correctable in this code. In summary: 


e one-qubit bit-flip errors are correctable in the [3, 1];, code, but not in the [3, 1]; 
code. 

e one-qubit phase-flip errors are correctable in the [3, 1];, code, but not in the 
[3,1] code. 


Moreover, we see from (7.45) and (7.50) that 
(20191 [22090) 70, 


апа it follows from Theorem 7.22 that error operations with more than one-qubit-flip 
error are not correctable in the [3, 1];, code either. 


We mentioned already that condition (7.68) ensures that the corrupted states are 
sufficiently ‘distant’ from each other so that we can recover the uncorrupted code- 
word. Similar to the classical world, it is thus useful to define the notion of a distance 
of a quantum code. Its definition incorporates the condition (7.68) by making use of 
the fact that IHC« C НУ = "Н" and that the n-fold PAULI group Ф, (see Sect. F.5) 
acts on IH", 


Definition 7.24 Let C, be an [n, к], QECC, and let (| ,)) be the ONB of 
basis codewords in НСч. The distance of Са is defined as 


all g € Ф, such that there exist |‘), |%) € 
dp(C4) = min { wo(g) | {|¥%)} satisfying (#03) # /()бу for}, 
every f : Pa, —> C 


where wọp(g) is the weight as defined in Definition F.63. An [n, к], QECC Cq 
with distance d = d: (C4) is called an [n, k, d], code. 


Exercise 7.90 Show that for the SHOR's [9, 1]; code Са; of Example 7.15 there 
exist g € Po with wp(g) = 3 such that 


CESE) A Fle) Oxy 
but that for any h € Po with wp(h) < 2 we have instead 
(PAP) = (А), 


and conclude that this code has distance three, namely that 
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(Са) =3. (7.93) 


For a solution see Solution 7.90. 


Next, we establish the useful fact that any linear operator on НУ = "IH?" can be 
written as a linear combination of elements in the PAULI group. 


Lemma 7.25 Any A € (“Н”) can be written as a finite linear combination 


of the form 
A = ау, 
J 


where aj € C and hj € Py. 


Proof From Exercise 3.45 we know that any A € L(*H?") can be written in the form 


A = . У i ji v joie 8 DE GAj ы (7.94) 


where aj, |... € C and Aj, € (H), and from Exercise 2.35 we know that any 
Aj, € ЦН) can be written in the form 


3 
A=. }, Za; баз. (7.95) 
Oj, =0 


Inserting (7.95) into (7.94) yields 


3 3 
А = У, АЛЕТ, > ар Oo; | Go уу aj Оо», 
‚=0 


Jn—1l: Jo Oj, = у= 


= bi x 4j, 1,4900, | 89 бор > 


Jn—1: JO jl mm Qj, —0 


where Definition F.63 tells us that Og; ®-°@ Ооу, є ?,. 


1 


Since for [n, к], codes we have Н“ = "IH", the operation elements £, of апу 
error operation belong to ЦН”), and it follows from Lemma 7.25 that any oper- 
ation element can be expressed as a linear combination of elements of the PAULI 
group. If the elements h; of the PAULI group used in the linear combination 
Ea = Y, ajh; are correctable by some recovery R, then Corollary 7.21 tells us that 
the error generated by the €, remains correctable by the same recovery. This way it 
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suffices to study errors in the PAULI group: its elements generate all linear operators 
of H and correctability is preserved under linear combination. This also explains 
why in the stabilizer formalism to be presented in Sect. 7.3.3 it suffices to consider 
error correction on the n-fold PAULI group ?,. 

The following proposition is in some way a quantum analogue of Proposi- 
tion 7.11. 


Proposition 7.26 Let Cq be an |n, К], QECC and € = {Ea} a u-qubit error 


in HC« such that 
do (Co —1 


u < ea") : (7.96) 


Then € їз correctable. 


Proof From Lemma 7.25 we know that every operation element €, € ЦН” ) of € 
can be written as 


Ea = $ ajhj (7.97) 
j 


with a; € C and Л; € P,. By assumption € is a u-qubit error. It follows from Def- 
inition 7.16 and 3.21 that each h; can act non-trivially on at most u qubits, and we 
must have for any ё. € € and all the PAULI group operators h; in their expansion 
(7.97) that 

wep(hj) <u. (7.98) 


With E€, = >, руу this implies for all Сл, £j € € and their PAULI group expansion 
operators h; and A; that 


wo (Mh) < wọ (hj) + we (hi) © 2и _< %у(Су). (7.99) 
(F.136),(F.135) (7.98) (7.96) 


It follows for any Eq, Ep € € and any basis codewords |¥%,), |Ҹ,) € НС that 


(баа) =, с ою (X, b) %) 
— d 
(2.31),(2.30) j ! 
ajb (Pha P) = ajbi f (hihi) буу 
» J J У м2 >, J J 


(7.99), J! 
Def. 7.24 


ed 
(2.32),(2.4) 


=“ab 


= Cab Oxy 


and thus from Theorem 7.22 that € is correctable. 
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Proposition 7.26 allows us to make a statement about the error correcting capa- 


bilities of SHOR’s [9, 1], code. 


Corollary 7.27 SHOR’s [9,1]; code Са; of Example 7.15 corrects all 
one-qubit errors. 


Proof The claim follows immediately from the result (7.93) of Exercise 7.90 and 
Proposition 7.26. 


7.3.2 Detection and Correction 


Having defined error and recovery operations together with their operation elements, 
we now proceed to establish a process to detect and subsequently correct an error. 
When trying to correct an error in the code, we cannot apply all recovery operators 
as this would in general apply more changes than are needed. Rather, we need to take 
into account which error has occurred and gear our recovery operation accordingly. 
Finding out which error has actually occurred is called error detection. 

Error detection is accomplished with the so-called error syndrome. The syndrome 
will serve to point to the error operator which has corrupted the code. This informa- 
tion is subsequently used to select the appropriate recovery operator to correct the 
error identified. 


Definition 7.28 Let C be an [n, 4], QECC and ё = {€, Є ЦН”) |aerc 
No} be an error operation in Hea such that it includes the non-error &0 = 
/po12" and its operational elements satisfy for all a € I 


Co = Pecan Pee Olle po ЕЕ Cw 


Furthermore, let HS be a HILBERT space of dimension dim H’ = |/| and 
{|@a) | a € I} bean ONB in НЗ. We define the syndrome detection operator 
for € as a norm-preserving operator Se : НУ — IH & HIS which satisfies 


Se(&;| y) = 21|) ә |a) VEa € E and |P) e HS. (7.101) 
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The space H’ is called a syndrome space for € and the state | ф„) the syndrome 
state for ĉa. Observing ЇН? to detect |a) and determine a is called syndrome 
extraction, and we call a = syn, (€a) the syndrome of Сл. 


With the help of syndrome detectors we can then formulate a quantum error 
detection and correction protocol for a given error operation € in an [n, k]; QECC 
as follows: 


Quantum Error Detection and Correction Protocol 


1. Let |У) € IH be a (possibly corrupted) codeword 

2. Apply the syndrome detection gate Sg for the error operation € to |) to obtain 
Se |Р) 

3. In the syndrome space IH? measure the mutually commuting observables 


Pa = |Фа) (Фа 
for all a € I in the state 
рэ = шї (Se I (P| st) € D(H’) 


until one observation yields the (eigen-)value 1. Let à € / be the single value in 
I for which this is the case 
4. Apply the recovery operator 
Rz := Eš (7.102) 


to the state ИКЕ 
p^ = ts (Se I (P| St) € D(H”) 
to obtain the corrected state 
К(р^) = Rz; p" Rž, (7.103) 


and proceed with this as the state of the presumed original uncorrupted codeword 
I"). 


The proof of the following proposition shows how the detection and correction 
protocol indeed corrects errors belonging to the error operation €. 


Proposition 7.29 Let Cq be an [n, К], QECC and € = {Eq | a € I} a cor- 
rectable error operation in H4 with error operators Êa. Moreover, let |) € 
НС be a valid codeword, and let 
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IP) = às (7.104) 


be the state after some error operator és has corrupted it. " 
Then the error detection and correction protocol recovers |P) from |P). 


Proof After the detection operator Se is applied to the corrupted state r2 the com- 
bined system is in the state (written as a density operator) 


Psp = Se (HSE =, Ёа) @ loa) Pê @ (Ф 
(2.89) (7.104),(7.101) 


Са) (5 9 | a) (Фа. 


N 
© 


_— 
(3.36) 


From Theorem 3.17 we know that then the sub-system IH describing the encoded 
system is in the state 


=1 


X А SR A 
p^ = i (баз) (IE; lga) (pal) = (еа) (pal) Eal Y) (I8; 


_— 
(3.57) 


= ёам) 125 


a? 


where we used that {|4} } is an ONB in IH? such that 


tr (la) (Pal) = È (Pala) (Pala) = 1 - 
(2.57) É =ð; —Ó 


Similarly, we know from Corollary 3.20 that the syndrome sub-system IH? is in the 
state 


=1 
———— 


pS = ш“ (EaP) (IE; e lo (pal) = т (6919) (162) Iga) (pal 


Ww Ww 
(3.50) (3.57 


= |) (al, (7.105) 


where we used that by assumption (7.100) we have ё, € U(HY ) such that 


tr( égj) (PEL) = e (|W) Р tr(py) = 1. 
SY’ 


(2.58) (2.37) (3.50) 


From (7.105) we see that with P, = |ф) (Ф| we find that 
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PR = 1a) (Pal Pa) (Фа Фа) (Pal = OP; ; 
————— 
(7.105) zb. "de 


and only a measurement of P; in this state will yield a value of 1. Therefore, we will 
find а as the error syndrome of Step 3 of the protocol. Consequently, we obtain for 
the state corrected by Rz — £7 of Step 4 of the protocol that 


RN) = Rap" RE = Pip êa = iê PPa =, Ivy] 
(3. ed (7.102) (7.105) &;e (RN) 
== pv. 
(2.89) 


The above mentioned error detection and correction protocol is thus designed to 
recover from the errors which occur in the error operation €. Errors caused by oper- 
ators which do not belong to € will in general not be corrected by this procedure. 
This is the case when the error is caused by an error operator Ё € U (HN ) which has 
the same syndrome as an error in € but is not part of €. In other words, whenever 
syndrome detection yields syn, (Ё) = syn, (Êz) =a but E Æ zêa for all z € C and 
Ea € €, then the correction protocol fails to recover the original codeword |) from 


I$) = EY). 


This is because having detected the syndrome 4, the recovery operation will apply 
the recovery operator Rg = £7 and produce 


Beh) = &£ jw) z |Р). 
—— 
#1®л 


Therefore, we ought to collect the most probable errors in € first and correct them. 
In this case errors like the aforementioned € would be less likely and more of a 
rare event. A much better strategy, however, is to expand the error operation to 
include such С. In general this also requires that we enlarge the code such that the 
enlarged error operation remains correctable. An example for this is provided by 
the QECCs [3, 1];, and [3,1], of Examples 7.23 vs. the SHOR-code [9, 1]4ç of 
Example 7.15. From Example 7.23 we know that in [3, 1];, all one-qubit-flips are 
correctable, but not the phase-flips, whereas in [3, 1], all one-qubit phase-flips are 
correctable, but not the bit-flips. On the other hand, we know from Corollary 7.27 
that [9, 1], corrects all one-qubit errors. But then this code also requires a much 
larger redundancy. 
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Example 7.30 We illustrate the error detection and correction protocol for the one- 
qubit-flip error 29 in (7.44) with the QECC [3, 1]4, of the previous Examples 7.14, 
7.17 and 7.23. 

In this case we have H = ‘H®3 and €™ contains four operational elements with 
the four error operators given in (7.44). Hence, we set HS = "IH? as our syndrome 
space and select the basis |@,) = |st), where s,t € (0, 1]. A syndrome detection 
operator 


Sgor : HY = H9? > HY @ HS = "H9? e He? 
is given by 
See = — ([111) (111] + |000) (000]) & |00) 
+({110)(110] + [001) (001]) @ [01 
(/110)(110| + 1001) (001]) |01) е 
+(|101)(101| + |010)(010|) & |10) 
+(1100) (100| + |011)(011|) & |11). 
Any valid codeword is of the form 
|) = a|000) +5111) є TH? (7.107) 
(723) 


with a, b € C such that |||] = 1. Suppose then this is corrupted by the error oper- 
ator 


such that the corrupted state is 


IP) = EPpy = аё|000) +0111) = а|010) +6101). (7.108) 
(7.107) (7.45) 


Applying the syndrome detection Sew, we see that the correct syndrome 10 is 
detected: 


Sgor | V) =, aS gor |010) + b Sg» |101) = 
(7.108) (7.106) 


(а|010) + b|101)) & |10) 


such that according to the protocol we apply Rio = £1, to |) = En) and 
recover |) as desired. 

Figure 7.6 shows the circuit for detection and correction of one-qubit-flip errors 
in the [3, 1];, code. 


7.3 Quantum Error Correction 


Fig. 7.6 Illustrating the 
error detection, syndrome 
extraction and correction 
process between en- and 
decoding for the [3, 1];, 
code and the bit-flip error 
operation €°', The error 
operators for this error 
operation are given in (7.44). 
Measurement of o; & o; on 
the ancillas reveals the 
syndrome (s; so) which is 
then used to control which 
recovery operator Rs; sọ is 
applied 


Syndrome 
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Recovery 
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Error 
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Exercise 7.91 Show that the operator 5 = B2B,A2A, in Fig. 7.6 is given by 


S=  ({111)(111] + |000)(000]) @1@1 
+(|110)(110] + |001) (0011) @1@X 
+(j101)(101| + |010)(010|) 9X 91 (909) 
+01100) (100] + |011) (011) 9X & X . 


For a solution see Solution 7.91. 


To illustrate that errors E not in €° will in general not be properly corrected by 
this code and protocol, let us now assume that the valid codeword as in (7.107) is 


corrupted by а two qubit-error Ё = iste oF such that the corrupted state is 


a& £9 |1000) + bÊ» êY 1111) 


(7.107) 
= aê |010) + bE |101) = a|110) + b|001) . (7.110) 
(7.45) (7.44) 


Applying the syndrome detection S por, we see that the syndrome 01 is detected: 


Sor |) = aS gor |110) + b S gvr |001) 
(7.110) 


= | (a|110) + Ь|001)) & |01) 
7.106 


~ 
КӘ) 


such that, according to the protocol, we apply Ro; = e to IP) and obtain 


Eg P) ES £i (a] 110) + b|001)) == а|111) + b|000) £ |У) ; 
(7.110) (7.44) (7.107) 


7.3.3 Stabilizer Formalism 


The stabilizer formalism provides a neat and compact way to describe QECCs with 
the help of group theory [102, 103]. Due to the fact proven in Corollary 7.21 that 
correctability is preserved under linear combinations of operation elements, and 
because any operation element can be expressed as a linear combination of ele- 
ments of the PAULI group, it is sufficient to consider only operation elements which 
are elements of the PAULI group. 
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АП necessary group theoretical notions required for this section are provided in 
Appendix F. 
From Definition Е.27 we recall that the left action A of a group 9 on a set M is 
defined as the map 
A:S9xM —M 
(gm) — gm 


satisfying for all g, h € 9 and m € M 


еѕ.т = т 


(gh).m = g.(h.m) . 
and that the stabilizer of any subset Q C M is defined as 
Stag(Q) = {g € S| g.m 2 m Vm e Q}. 


Moreover, from Exercise F.130 we know that any such stabilizer is a subgroup of 9. 
In the context of QECCs these notions are applied as follows 


9 = Pa 
M = H” = gr" 
Q=H%. 


The code is then determined by the specification of a suitable subgroup $ < P,. 
This subgroup in turn determines the code space. Our first task is to establish that 
the space determined in this fashion has the right properties to serve as the code 
space Hs of a QECC. 


Theorem 7.31 Let k,n € N with k < n and let $ be an abelian subgroup of 
Pn generated by independent {81, . . . , g, 4] satisfying —1°" ¢ S, that is, 
=” ¢ S= (Gino son а=) E 


Then 
Span (|) € "H?"| |) =|") Vege S) 


is а subspace of "IH?" of dimension 2". 


Proof We begin by establishing that the g; only have the two eigenvalues +1. 
From Proposition F.62 we know that every g € P, < U(‘H®"”) satisfies g? = +18” 
and g*g = 1®". Since by assumption — 1?" £ (g1,..., g, 4), it follows that every 
gi € (g1,... gn] satisfies g = 1°". Furthermore, if we had gj = —g;, it would 
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follow that —g? = 1*" and thus g? = —1*". But this would contradict —1°” ¢ 
(g1,---,8n—k), and it follows that we must have gj = gı. Consequently, g; € 
В, ("Н"), and the eigenvalues of all g; are real. Moreover, since g € U(*H9"), we 
infer from (iii) in Exercise 2.8 that any such eigenvalue satisfies |A;| = 1. Hence, 
every g; has only the two eigenvalues A; = +1. 

For each (n — k)-tuple (A1,..., An-x) € {+1}""* we define the subspace 


Ele uda = Span У) € He” | gi|'P) = AP) MES (1, ee lh k}} А 
(7.111) 
which by definition satisfy 


Haa) C Eig(gn A). Vl € (1,...,n—- k}. (7.112) 


It follows from (7.112) that for (À1,..., As x) Æ (Ui, ---,Un-k) the subspaces 
Ay An) and Hj, , are orthogonal. This is because there must be at least 
one / such that A; Z и, and since eigenspaces of self-adjoint operators for different 
eigenvalues are orthogonal, we have 


(7.112) (7.112) 


From Proposition F.72 we know that there exist ^; € P, for j € (1,...,n — k} such 
that for every | € {1,...,n—k} 


gih; = (—1)9%/һу&. 


Hence, for |P) € 1904, л, у we have 


Ai; W) | ifjzl 


hP) = (—1)9/h;e; PY = (—1)9UA;A;|w) = 
gihj|'P) = (1) hjg P) = (1) uh; P) a j=l. 


such that for all |) € Ну, л 


n-k) 


nq e Hn epe аьа (7.113) 
Since h; € U(‘H®") it follows that 


dim A an = dimus 4 Ay Rn a) (7.114) 
Moreover, (7.113) shows that by application of a suitable set of ^; we can unitarily 
map апу Ho, 5 ,)to any Н, _,)- Together with (7.114) this implies that all 
these subspaces have the same dimension, namely 


=J V(Ài,..., An-k) € {+1} 7*. 


dim Hy, ›+%Ай—Е) 
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Altogether we have thus 2”~* mutually orthogonal subspaces of equal dimension J 
which together comprise "IH". It follows that J2"-* = dim "Н" = 2" and thus 


2 = J =dimHy, E А 


п-к) 


VAL, sae ‚ Аһ—к) Є {+1}"-* Я 


Finally, note that g = 211 ---g7"* for any g € $ = (g1,..., n-k), Where aj € 
, 1} since g? = or any g € 8. Consequently, 

0, 1} since g? = 18” for any g € 8. Consequently. 
) =, Span (|3) є He | |У) = |9) Vie {1,...,n— k)) 
(7.111) 

= {|¥) € H” |Vee8: 2) = |Ҹ)}. 


We thus define the notion of a stabilizer (error correcting) code as follows. 


Definition 7.32 An [n, к], QECC C, with code H“! is called a stabilizer 
code if there exists an abelian subgroup $ of P, that is generated by indepen- 
dent {g1,..., g, 4.) and satisfies — 19" ¢ 8 such that the code HI is given 
by 

H^ = 3) ЄН“ | |) = |3) veges}. (7.115) 


The subgroup 
8 = Stay, (H^) = (ge P, | |) = |) vj) e НС) 


is called the stabilizer of the code. 


The reason — 1%" is excluded from 8 is that including it would result in a trivial 
Hs. This is because (7.115) would imply for g = —1^" for all |) є Hs that 
|) = —|V^, resulting іп IHC« = {0}. 

In the stabilizer formalism it is the subgroup $ of the n-PAULI group P, which 
determines the code НС. In general 8 will be specified and Нч is then given as 
the subspace of HI" consisting of all vectors which are invariant under the action of 
every g € 8. Hence, апу |У”) є Н“ for which there exists at least one g € $ such 
that g| V) 5 |) cannot be in the code НС. 


Example 7.33 Consider the two [3, 1]; codes of Examples 7.14, 7.17 and 7.23. The 
code [3, I], p which can correct bit-flip errors, has the basis codewords 


М0) = 1000) and |) = |111) 


апа the bit-flip error operators 
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é 219191, @=1@1@0%,  5-1eee1, Pí-oseiel1. 
The stabilizer of this code is $ = (g1, g2), where 

g1 =0,80,81 and g2=0,8180,. 
On the other hand, the code [3, Iaz» which corrects phase-flip errors, has the basis 
codewords 

МОШ +++) and |Ф)у=|———) 

and the phase-flip error operators 
êf =1%1®1,  éPF-18616o6, 60-19091, &"-oe1el. 
The stabilizer of this code is $: = (Лү, һә), where 


h = О, ® О, 8&1 and hyp = О, ®1®об‹у. 


Lemma 7.34 Let Cq be an [п, К], QECC with stabilizer $ < Ф, апа N(S) 
the normalizer of S. Furthermore, let {|%,)} be the ONB of basis codewords 
in Н“, and define 


there exist. |P), |P) € {|Ч„)} such that 


M, i {6 67, (Ig P.) + f (g)às, for every f : Pa — C jj ang 


Then we have 
Mz C N($) 8. (7.117) 


Proof Recall first that by Definitions Е.27 and E.16 


S = {g € Pa| iP) =|") viv) eue) 
N(8) = {g € Pn | 88 = 8g), 


and that Exercises F.130 and F.126 showed that they are subgroups, that is, $ is the 
subgroup of Ф, which leaves every vector in HI“ unchanged, and the normalizer 
N(S) is the subgroup of all elements in P,, which commute with every element of 8. 

We show the inclusion by proving the contrapositive. First let g € $. Then it 
follows for any two basis codewords that 
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(Els E) = GA) = dry 


YY 
ges 


and thus g ¢ Mz. 

Now suppose g ¢ N(8) such that gS 4 Sg, which implies that there exists at 
least опе л € $ such that for all л € 8 we have ghz hg. This also holds for h = A. 
It follows that for any g € N(S) У $ there exists at least one h Є $ that satisfies 


gh# hg. 


But from Proposition F.70 we know that for any g,h € P, either gh = hg or 
gh = —hg. Hence, for the g and h at hand we must have 


gh = —hg, (7.118) 
and thus any pair |%), |Ҹ,) € НС of basis codewords satisfies 


(9) = (leh) =, -Elh B) = (А.а). (7.119) 


hes (7.118) (2.30) 


Any h € P, satisfies Л*Л = 18” and thus h* = A^!. From Exercise F.130 we know 
that $ is a subgroup of P,„, and since h € S, it follows that h* = h-! є 8. Hence, h* 
leaves every vector in Hs invariant. Consequently, we obtain 


(18%) (ИР |) =, (|5), 


ари ари 
(7.119) h*eS 


which implies 
(166) = 0 = f(g) dy 


with f(g) = 0 and thus g € Mz. We have shown that 


5868 > g¢Mz and gE€N(S) = gEMz 


and the contrapositive yields g € Mz => g € N(S) ~ $, which implies (7.117). 


The following theorem gives a group theoretic criterion for an error to be cor- 
rectable. 


Theorem 7.35 Let Cq be an |n, К], QECC with stabilizer $ < , and = 
{Ea} an error in the code Ha with operation elements Ea € Pn. Moreover, 
let N(S) = Nor, (S) denote the normalizer of $ in P,. Then we have 
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VEa Ep EE: EZEp N(S) xS = E= (£4) is correctable in НС. 


Proof Let £7 Ep ¢ N(8) ~ 8. Then it follows from Lemma 7.34 that E} Ep € Mz 
and, therefore, that for all basis codewords |), |Ҹ,) € НС 


(Ea P| Ep Y) - 5 e Ep V) - f(E £5)6,y - ab Oxy E 
(2.30),(2.31) 


and Theorem 7.22 implies that € = {€,} is correctable in НС. 


From Proposition F.70 we know that any two elements of the n-fold PAULI group 
either commute or anti-commute. Therefore, the following definition is meaningful. 


Definition 7.36 Let C, be an [n, к], QECC with stabilizer 
S = о n «€ dise (7.120) 
We define the syndrome map of the stabilizer QECC C, as 


syn, : 9, — Rit 


а (7.121) 
Ө Кк (ue ee 
where 
0 ifgg;—g; 
(Ec к с (7.122) 
1 if gg; = —8j8 


for j € {1,...,n— k}. 


Note that the syndrome map depends on C, since the component functions /; are 
defined with the help of the generators of the stabilizer of Cy. 


Example 7.37 Consider first the code [3, 1];, with generators gı and g2 given in 
Example 7.33. From Example 7.23 we d that this code corrects single-qubit 
bit-flip errors. The bit-flip error operators си for s,t Є {0, 1} have ће syndromes 
shown in Table 7.1. 

From Example 7.23 we also know that the code [3, 1]; with generators Л and 
hg given in Example 7.33 corrects phase-flips. The phase-flip error operators ce for 
s,t € {0, 1} have the syndromes shown in Table 7.2. 
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Definition 7.36 is the quantum equivalent of the classical syndrome defined in 
Definition 7.9. The following lemma establishes the quantum analogue of (7.12). 


Lemma 7.38 Let $ be the stabilizer of an [nk]; QECC Cq and syn, the 
syndrome map of Cg, and let №8) denote the normalizer of 8. Then we have 


М(8) = Ker(syn,) . (7.123) 


Proof Let h € N($). By Definition F.16 this implies hS = Sh, which means 


Yges AES: hg— gh. (7.124) 


On the other hand, we know from Proposition F.70 that for any h,g € P, either 
hg = —gh or hg = gh. Suppose hg = —gh. Then it follows from (7.124) that g = 
—g and thus 

—19" = 0168. 


But —1®” € 8 contradicts the defining assumption in Definition 7.32 of $ being a 
stabilizer of the QECC C,. Therefore we must have g = g and thus 


Table 7.1 [3, 1],,-syndromes for one-qubit bit-flip errors 


g 881 = +818 882 = +828 h(g) (8) 
e ee = e 

e eue = seh, [50e = n5 |0 1 
ё% вт nt |2082 = 8225 | 0 
en en --n85 [£o = -g:i |1 1 


т = тё 


ёл» = рё 


get Фр = mer |р – ё | 0 1 
ёр êri = – 200 | 20р, = hê |1 0 
en ёр = hê |201 = -mê |1 1 
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hg =gh | Vg e 8 = (gi... 8n-k) 


eR hg; gjh  Vgj € {81,...,&п—К} 

(7.120) 

ә, dj =0 Vj € (L...,n—k) (7.125) 
(7.122) 

ә, вуп (Л) = 0, 


(7.121) 
which implies Л € Ker(syn,) and thus 
N(S) C Ker(syn,) . (7.126) 
To prove the converse inclusion, let h € Ker(syn,) such that syn, (л) = 0. Then it 


follows from (7.125) that hS = Sh and thus h € N(S). Therefore, Кег(ѕуп,) C N(S) 
and together with (7.126) thus №(8) = Ker(syn,). 


The following Exercise 7.92 is the quantum analogue of Exercise 7.83. 


Exercise 7.92 Show that syn, as defined in Definition 7.36 satisfies for any h1 , h2 € 
Pa 


2 
syng(hıh2) = syn,(h1) © syn, (^о) 
such that syn, is a homomorphism, that is, 
syn, € Hom(P,, Fy“). (7.127) 


For a solution see Solution 7.92. 


Lemma 7.39 Let 8 be the stabilizer of an |n, к], QECC Cg. Then the nor- 
malizer N(8) of 8 is a normal subgroup of Pn, that is, 


N(S) a Pn. 


Proof From (7.127) and (7.123) we infer that N (S) is the kernel of а homomorphism 
from P, to re, The claim then follows immediately from Lemma F.30. 


Having established that N(S) < P,, it follows from Proposition F.22 that the quo- 
tient group P„/N (S) exists. This allows us to formulate the following proposition, 
which is the quantum equivalent of Proposition 7.10 and which will enable us to 
establish a quantum error correction protocol similar to the one presented after that 
proposition. 
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Proposition 7.40 Let syn, : Pn — F п-к be the syndrome map for an |n, К], 
QECC C, with stabilizer $, and let N(S) be the normalizer of $. Then 


syn, : P,/N($) — F7 * 
[8]м) Жы syn,(g) 


is an isomorphism. 


Proof From Lemma 7.38 we know that N(S) = Ker(syn,) and from Exercise 7.92 
that syn, € Hom(?P,, ЕЛЕ), If we can show that F7 = syn, {Pn}, then the claim 
follows immediately from the First Group Isomorphism Theorem F.31. 

To show that Fr = syng{ Pr}, let a € ps *. Suppose am = 1 for some 
m € (1,...,n — k}. From Proposition Е72 we know that there exists an hm € Ф, 
such that for all j € (1,...,n — k} 


=f ат hy Н if — 1 
gjlim = (-1)9 hmg; = (-DP^hwgj ne (7.128) 
For each m € (1,...,n — k} for which am = 1 let hm be one of those that satisfy 


(7.128). For those m € (1,...,n — k} for which am = 0, set hm = 1°". Then we 
have for 


hah} ed (7.129) 
that 
2 NA nk a aj—] NAI nk 
gh = 8) Rh, —, he УР" 

(7.129) (7.128) 

_ а ај–1 i pij aj+1 а-к __ JA п-к 
cde BL (- Eh аз cxt c С eh By 
(7.128) (7.128) 
= (-1)%he;. 
(7.129) 


Hence, (7.122) implies /;(h) = aj, and it follows from (7.121) that ѕуп (л) = a, 
which implies syn, {F3} = ЕК and completes the proof. 


Similar to the classical case with syn, of Definition 7.9, we would like to use 
the quantum syndrome syn, for detection of errors and subsequent correction in a 
quantum code. To see how this can be achieved with a stabilizer QECC [n, К], with 
stabilizer $, let ё € Ф, be an error operator having corrupted a codeword |) € 
IHC« = "IH"-* such that 7 

|) = |У) (7.130) 
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is the codeword received or retrieved. Then we have for any generator gj € 8 used 
to determine the syndrome 


~ 79 . & ж 
gjlV) = gj£*) = (uO gP) 
(7.130) (7.122) gjc8 (7.130) 


that is, the corrupted codeword ka) is an eigenstate of each generator g; with 
eigenvalue (—1)!/'ё). Therefore, we can measure the the observables g;, where 
j € (L...,n — k}, without changing the corrupted state |F} to obtain the mea- 


surement results (— Duo, Taken together, all these measurement results reveal the 
syndrome of С: 
syn (£) = (h(&),..., In-x(Ê)) EFS. 


^ 


But Proposition 7.40 tells us that вуп (©) does not uniquely identify the error €. 


It only determines the coset H (8) to which the error operator ё belongs. We 
N 


can then use the isomorphism provided by syn, to identify this coset В Маў? We 
assume that the error which changes the smallest number of qubits is the most likely 


to have occurred. Therefore, we pick an element g € В xdi which has the min- 


imal weight in the coset. Having chosen g € E (8) means that there exists an 
N 


h € N(8) such that g = Êh. We then apply a gate implementing g* to |W) to correct 
the corrupted codeword. This way, we obtain the codeword 


g$ = (£n) |), — e|) a 


Exercise 7.93 shows that the result h*|Y) of our correcting transformation |) > 
g* |W) is again a valid codeword in ІН. 


Exercise 7.93 Let S be the stabilizer of a QECC Cg with code НС, and let N(S) 
be the normalizer of $. Show that then for any h € N(S) and |W) € НС 


h|W) є HC. 


For a solution see Solution 7.93. 


Since N(8) is a subgroup of Ф„ and h € N(S), it follows that h* = A^! € N(8) as 
well. Moreover, since the original codeword |) was an element of Hs, the result 
of Exercise 7.93 tells us that h*|¥) є НС and is thus a valid codeword. In general, 
however, we have no guarantee that h* |V^) = |) and the original codeword is fully 
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recovered. Only if we have been lucky enough to have selected h in g = Éh from 
the stabilizer, namely such that h € $ < N(S), would we end up with A*|W) = |). 

In summary, our quantum error detection and correction protocol is thus as fol- 
lows: 


Quantum Error Detection and Correction Protocol for Stabilizer QECC 


1. Let |) € IH be a (possibly corrupted) codeword 
2. Determine /,..., [, 4 by observing all generators gj of 8 = (g1,..., gi 4) in 
the state |'P), which satisfies 


gj) = CDF), 


and set syn,(£) = (п, Р TES 
3. Determine В S syn, ' (syn,(é)) 


4. Determine the set of elements in this coset with minimal weight 


Ron В á := {he BW | wp(h) < мр(е) Vg € В 


} 


N( N(S) 


5. Select a random element | 
env [| 
BENT LM Is) 


6. Transform |) +> g*|¥) and proceed with g* |F) as the presumed original code- 
word for |). 


Note that, whenever the measurement of all generators g; of $ = (gi,..., 8n—k) 


reveals syn, (Ê) = 0, the identification of the coset by syn, | yields В (8) = 
N 


N(8). Since N(S) is a subgroup, it contains 19", Therefore, we have in this case 


ee [Es e ther], oth = 8} e оңу, 


(F.134) 


and the action of g* is at most only an irrelevant phase multiplication of i^, where 
a € {0,...,3}, in other words, the error correction procedure leaves the state |У) 
unchanged if the syndrome vanishes. 

We conclude this chapter on error correction with a result which is a quantum 
analogue of Proposition 7.11 and a stabilizer version of Proposition 7.26. It gives 
yet another sufficient condition for correctability, this time in terms of the weight of 
error operators and the distance of the code. 
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Corollary 7.41 Let C, be an [n, К], stabilizer QECC and € = {ёа} an error 
in HC with operation elements Eq € Py. Then we have 


ар(Са) — 1 
wp(Eqg) < жр || VEEE > € iscorrectable іп НС. 


Proof Let 


we(Eq) € ea (7.131) 


hold for all €, € €. Since |х| < x, we obtain for any Ea, Ep € € that 


wp(E,&) < we(Ey) +we(Ey) € we(Ea) + we(Ep) 
(F.136) (F.135) 
"E d» (C4) — | 2 „%>(С4) =1 
MY 2 = 2 
(1.131) 
< 4р(Са) = min { У/р(8) | g E€ Mj). 


Def. 7.24, (7.116) 


Therefore, we must have ©, €, ¢ Mz, and (7.117) implies that then £7 E, ¢ 
N(8) ~ 8. It follows from Theorem 7.35 that € is correctable іп НС. 


7.4 Further Reading 


An introduction to classical error correction can be found in the book by PLESS [104]. 

For a more introductory and less mathematical exposition the reader may consult 
the review article by STEANE [105] or the more recent one by DEVITT, MUNRO and 
NEMOTO [98], which also references a great many of the original contributions. 

More mathematical, albeit without proofs, but nonetheless eminently readable, 
is the review by GOTTESMANN [100]. A good comprehensive and mathematical 
treatise on the subject of quantum error correction is the book by GAITAN [106]. 

The voluminous collection edited by by LIDAR and BRUN [101] covers a very 
wide range of topics related to quantum error correction and fault tolerant quantum 
computing including more recent developments. This book also contains a chapter 
on topological quantum codes first proposed by КІТАЕУ [36, 107, 108]. 


Chapter 8 A) 
Adiabatic Quantum Computing genet 


8.1 Introduction 


In exploring how the laws of quantum mechanics can be utilized to improve algo- 
rithms, we have essentially looked at what happens when we replace classical logic 
gates or circuits with their quantum versions. We call this circuit (or gate) based 
computation or computational model. Adiabatic quantum computation is an alto- 
gether different, albeit equivalent, way to harness quantum effects for the benefit of 
computation. Even though both the circuit based and adiabatic quantum computa- 
tional model utilize the laws of quantum mechanics, they differ substantially in their 
approach. 

The circuit based model (see Definition 5.27) uses a finite number L of gates 
Uj, ..., Uy to build a circuit О = UŁUz-1 ++ 7501. For pure states this circuit U 
then acts on an initial state |V4,;) to produce the desired final state 


|) = ШЧ) = ULUL-1 -+ 0201 fs) 


as the output of the computation. 

In contrast, the adiabatic quantum computation uses a time-dependent Hamilto- 
nian H(t) to generate a time evolution U (tfn, fini) that transforms the initial pure 
state |Y%4,;) into a state close enough to the desired final state |), that is, 


|| Pin) — U (tan, fini) 1) || < 1 


such that after |‘%,;) has been subject to the time evolution we should find |.) with 
a high enough probability. 

The quality of the adiabatic method then depends on finding a suitable H(f) that 
generates a time evolution such that U (tfn, fii) |) is as close as possible to the 
desired final state | ЧӨ). However, the transition time T = fg, — fini required for this 
should not become too large, so as not to suffer from decoherence effects. We shall 
explore all these aspects in this chapter, which is organized as follows. 
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In Sect. 8.2 we state the assumptions underlying the adiabatic method and derive 
important results about the quality of the adiabatic approximation, which is at the 
heart of this method. In doing so, we make use of the Quantum Adiabatic Theorem, 
for which we give a thorough proof in Appendix G. 

A generic version of the adiabatic method is presented in Sect. 8.3. As an appli- 
cation of this, we then look in Sect. 8.4 at a search algorithm using the adiabatic 
method. There we also show that with a suitably adapted algorithm the efficiency of 
the GROVER search algorithm of Sect. 6.9 can be obtained. 

Since both the adiabatic and circuit based method produce the final state, the 
question arises if one method might be more efficient than the other. In Sects. 8.5 and 
8.6 we shall show that the two approaches are indeed equivalent in their efficiency. 
More precisely, we shall show: 


(i) in Sect. 8.5 that adiabatic quantum computation can efficiently approximate 
any circuit computation, in other words, the final state Uz - - - Ui |) of a cir- 
cuit computation with L gates tuj | j€tL... Lj] can be obtained via an 
adiabatic quantum computation with a probability ы, and a transition time 
Tc O(1L9) is sufficient to achieve this; 

(1) in Sect. 8.6 that the circuit based approach can efficiently approximate any adia- 
batic quantum computation, that is, the adiabatic time evolution U (T + tini, fini) 
can be approximated up to an error of 6 by a circuit of J gates, where 


T\2 
Je o((5) ). 
Throughout this chapter we often use notions and results from Appendix G, which 
the reader is encouraged to consult. 


8.2 Starting Point and Assumptions 


Ever since its first formulation by BORN and FOCK [109] in 1928, the Quantum 
Adiabatic Theorem has been recast in various guises. Here we follow the approach 
first developed by KATO [110], which has been refined numerous times, and adopted 
to the context of quantum computing by JANSEN et al. [111]. 

All these formulations concern the following situation: we are given a quantum 
system with 


e an initial Hamiltonian Hini at some initial time tini 
e a final Hamiltonian Нұһ at some final time tfn 
e atime dependent Hamiltonian 


H: [fini tän] _ Bs Hi) 
t > H(t) 
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such that 

H (fini) = Hini апа Н(ївһ) = Нал, (8.1) 

and the time evolution between / and tg, is generated by H(t), that is, the time 

evolution operator U (t, tini) for the system is given as the solution of the initial 


value problem 


dt 
U (tini, fini) : 


.d 
i—U(t, tini) = H(t)U (t, tini) (8.2) 
=1 


Any initial state | (tini)) evolves into the state U (t, tini)|W(tini)) atalater time t > fini. 

Let the system be prepared initially at time fj; in the jth eigenstate |®; (tini )) of the 
initial Hamiltonian Hini, and then let it evolve according to the time evolution gen- 
erated by H(t) until tfn. The question the Quantum Adiabatic Theorem addresses is 
the following: how well does this time-evolved state U (tfn, tini)|®;(tini)) agree with 
with the jth eigenstate |d5(t55)) of the final Hamiltonian Hg? Figure 8.1 illustrates 
this setup and the question for j = 0. 


fini tin = figi + T 
- T >| Ё 
H (tini) Se NO aa H (tin) 
Eigenvalues, eigenstates of H (fini) Eigenvalues, eigenstates of H (tfn) 


H(tini)| $;(fini)) = Ej (tini) | Pj (tini) Н()1Ф (а) = Ej (tin)| Pj (tin) 


Hlini) Фо (t5) = Eo (tnt) |B) 7 P t) Pa tin) = E2 (tin) | a (3) 
H (tin) Фи (tin)) = E1 (а) Ф (tin) 


H (tini)|Pr (fini)) = E1(tini) | d: (tini)) 


a Н(ївл)\ |Po(tin)) | = Eo(tan)| &o(tan)) 
H(tini)|Po(tini)) = Eo(tii)| |Po(tini)) | 


How close are they? 


| 


U (tin, fini) | Po (tini)) 


time 
evolution 
generated b 
time dependent H(t 


Fig. 8.1 Schematic representation of the question the Quantum Adiabatic Theorem addresses, 
where we consider the case of the ground state; in this illustration the left side depicts the eigen- 
values, in other words, the ‘energy levels’ of the initial Hamiltonian H(fini); the right side depicts 
the energy levels of the final Hamiltonian H(tfn); the curve emanating from |®o(tini)) represents 
the time evolution U (tfn, fini) generated by H(t) for this state and attempts to illustrate that it need 
not coincide with the ground state of H (tfn) 
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The Quantum Adiabatic Theorem tells us that under certain conditions these two 
states can be made made arbitrarily close to each other. One of these conditions is 
that the system exhibits no eigenvalue crossing during the time evolution. Another 
condition is that the transition from His; to На is sufficiently slow. 

Before we proceed to make these statements more exact and ponder their rel- 
evance for quantum computing, we introduce some further notation. For the for- 
mulation of the Quantum Adiabatic Theorem it is helpful to define time-rescaled 
objects. 


Definition 8.1 We denote the time elapsed between fini and tn > fini by 


T :— tin — fini (8.3) 
and define the rescaled Hamiltonian by 


Hr : [0,1] — BH) 


poseer TS (8.4) 


Similarly, we introduce the time-rescaled evolution operator 


Ur: (0, 1] = В(Н) 


: 8.5 
s —> Ur(s) := U (tni + ST, tini) (8.5) 


As a consequence of this definition, we have that 


t — fini _ 
Нт (== ) = H(r) 


(8.6) 
Ur (1) = U (tin, бав) . 
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Proof We have 


: .d 
di = Lg U ini 3-815 fini) 


d 
= iT- U(t, tni 
! dt ( , ini) t=tini +sT 


T [H(t)U (t, tini )| 


t=tini+sT 


TH(tini + ST)U (tini + ST, fini) 
THr(s)Ur(s) ; 


which proves (8.6). Moreover, 


0т(0) = U (tini; fini) = 1 
(8.5) (82) 


and 
Ur(1), — U (fni +T, tini) =U (thin, fini) - 
(8.5) (8.3) 


We denote the jth eigenvalue of Hr(s) by Е; (5), where the index j belongs to 
some index set J С No. Each eigenvalue £;(s) may have a finite, dj-fold degener- 
acy. The corresponding orthonormalized eigenvectors are thus denoted by |Ф; (s), 
where j € J anda € {1,...,dj}. Forj,k € 1,œ € {1,...,dj} and B € {1,...,d} 
they satisfy 

CNGLMCORENTM 


and 
Нт(5)|Фу(5)) = Ej(s)] 0j. (s) - (8.7) 


The eigenvalues E;(s) are often referred to as ‘instantaneous’ eigenvalues and the 
eigenvectors |®; „(5)) as instantaneous eigenvectors. Generally, the instantaneous 
jth eigenvector |®; „(5)) does not coincide with the state reached by time evolution 
from the initial state |®; œ (0)). That is, in general we have that 


|Фу«(5)) # Ur(s)|Pj,o(0)) = U (tini + ST, tini)|®;,a(0)) , 
and the goal of the adiabatic method is to design Hr such that, at least for a partic- 


ular j, this difference is as small as possible. In fact, what the Quantum Adiabatic 
Theorem provides is a bound on their difference. 
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Whereas t carries the physical dimension of time, the evolution parameter s is 
a pure number in [0, 1] and is dimensionless. Using Hr (s) and Ur(s) for s € [0, 1] 
instead of H(t) апа U (t, tini) for t € [fini, tin] is a matter of pure convenience. We 
can always obtain H(t) and U (t, fini) from Hr(s) and Ur(s) by the substitution s = 


Mini and vice versa by substituting t = tini + sT. For example, the E; (Sn) are the 


t— fini 


instantaneous eigenvalues of H(t) and |Ð; œ (—73)) their respective eigenvectors 
since (8.4) implies 


and thus 


For convenience, we shall mostly use the formulation in terms of s. For any s depen- 
dent object A(s) we also use the abbreviation 


Exercise 8.94 Let 
A: [0,1] — BH) 
s > A(s) 


be differentiable with respect to s. Show that then 


(209) = (Za) - < (абу) = (at) 


such that, in particular, if A(s)* = A(s), then also 


For a solution see Solution 8.94. 
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Throughout this chapter we always assume that during the time evolution between 
s = 0 and s = 1 (or, equivalently, between t = fini and t = tfn) the instantaneous 
eigenvalues E;(s) do not cross. In other words, we make the following assumptions, 
which we collectively denote by the term Adiabatic Assumption. 


Adiabatic Assumption (AA). We assume that 


Hr : [0,1] — B,4(H) 
s > Hr(s) 


is such that 


(i) Hr(s) is at least twice differentiable with respect to every s Є]0, Ц 
(ii) Hr(s) has purely discrete spectrum {E;(s) |j € I C No} for every s € 
[0, 1]; the eigenvalues may be d;(s)-fold degenerate, where the degenera- 
cies d;(s) are constant for s Є]0, 1] 
(iii) the eigenvalues E;(s) of Hr(s) do not cross, that is, for s €]0, 1] we have 


Eo(s) < Ei(s) < +++ < Ej(s) < Epa(s) <--> 


In some cases the Adiabatic Assumption (AA) (in particular item (iii)) may not 
be satisfied when considering H7(s) on the whole HILBERT space H. However, it 
may hold only on a subspace Hyp C H. If this subspace is left invariant by Ну, that 
is, if Hr(s) {Hsu} C Будь for all s € [0, 1], then the Quantum Adiabatic Theorem 
and its implications still hold for the restriction Нт |m. : Hsup — Нь. 


sub 


Exercise 8.95 Let |), |F) € H with ||®|| = 1 = ||| and let € € R be such that 
ПФ) – |") Il S e. (8.8) 
Show that then 


Фу] > 1—22. 


For a solution see Solution 8.95. 


With the help of our version of the Quantum Adiabatic Theorem G.15 we can now 
make a statement about the probability of finding a system in an eigenstate of Hg 
if it was initially prepared in the corresponding eigenstate of Hini. 


410 8 Adiabatic Quantum Computing 


Corollary 8.3 Let Hr be as defined in Definition 8.1 and be such that it sat- 


isfies the Adiabatic Assumption (AA). Moreover, let £j :— ERU where C;(s) 
is as defined in (G.45). Let a system initially be prepared in an eigenstate |E;) 
of Hini with eigenvalue Е;(0) and then subject to the time evolution generated 
by Hr(s) for s € [0, 1]. 

Then the probability to find that system at time tg, an eigenstate of Нр 


with the eigenvalue E;(1) is given by ||Р;(1)0.(1)=3] I: and satisfies 


llP;()ur (5p PM £, (8.9) 
J 
that is, we have 


To observe an eigenstate of Hg, for 
the eigenvalue Ej(1) at time tfn, 


P 4 if system was in an eigenstate |5;) > = |Р;(1)0т(1) 23| 21- 8g. 
of Hini for the eigenvalue E;(0) at 
time tinj 


Proof Note that since Нт (1) = Нал, Pj(1) is the projector onto the eigenspace of 
Нап for the eigenvalue E;(1). Moreover, by Lemma 8.2 we have 


Ur (1) = U (tàn, йы), 


where U (t, fini) is the time evolution generated by H(t). Starting from an initial state 
[Zj), the system evolves to the state U (tin, fini) Жу) = Ur(1)|Zj) at tin. 

The statement that llP;j(ur (1) = |? is the probability to observe ап eigen- 
state of Hg, for the eigenvalue E;(1), when the system is in the time evolved state 
т (1)| у), is the content of Postulate 2. It thus remains to show (8.9). 

For this let 


(8.10) 


where U4;(s) is the adiabatic intertwiner defined in Definition G.9. Consequently, 
we have 


Ii) — IGI] = 
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The result of Exercise 8.95 then implies 
|(Ф()[Ф(в))| > 1— ss. (8.11) 


With this we can show claim (8.9) as follows. For any s € [0, 1] we have 


||) ur (DEM? S Ua) P Ur; 
(2.37) 
=, |[Pi()UA S) Urs )s&lP . (8.12) 


(6.23) 


Since [|5;) is assumed to be an eigenstate of Hini = Hr(0) for the eigenvalue 
Ej(0), we can form an ONB of the eigenspace for this eigenvalue that contains 


|Zj) as one basis vector, that is, we form an ONB {| (0)) | we {1,...dj}} of 


Eig (Hr (0), E;(0)), where I; 1(0)) = |Ej). This means that we can express the pro- 
jector P;(0) onto the eigenspace Eig (Hz (0), Е;(0)) in the form 


dj 


- У ао) $;4(9) = I8) (5 + У, 18.0) (0. 


Moreover, as the (155. (0)) | œ € (1,...d;) ] are mutually orthogonal, it follows 
for any |Q) € H that 


Iro L]? =, -$ (Ga j.«(0)12) Í > Kio . (8.13) 
me 15) 


Setting |Q) = UA;(s)'Ur(s)|Zj), we obtain from (8.12) that 


mA = * ENIM 
||PiG)ur(s)&j|| 2 | GIU (8) Ur(s) 8j) 
(8.13) 
= mA 
= |(Uaj(s) 5107 (х) 5) | 
(2.30) 
= |(®(s)|¥(s))? 
(8.10) 
> 1- g(s} 
(8.11) 


and the claim (8.9) follows from taking s = 1. 
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Another way to use the result of Theorem G.15 is to derive a lower bound for 
the transition time T' if we want to achieve a given minimal success-probability to 
find an eigenstate of Hg, = Нт(1) at the end of the transition. In other words, The- 
orem G.15 tells us how slowly we have to change Hini = H7(0) into Hg, = Hr(1) 
if we want to find the system in an eigenstate of Нал, given that it was initially 
prepared in the corresponding eigenstate of Hini. This is made more precise in the 
following corollary. 


Corollary 8.4 Let Hz be defined as in Definition 8.1 and such that it satisfies 
the Adiabatic Assumption (AA), and let C;(s) be defined as in (G.45). Let a 
system initially be prepared in an eigenstate |5;) of Hini with eigenvalue E;(0) 
and then subject to the time evolution generated by Нт (s) for s € [0, 1]. 

If the time T for the transition from Hini to Hg, satisfies 


c0) 
М 1= Ртіп 


for pmin Є |0, 1|, then the probability to find that system at time tg, in an eigen- 
state of Hg, with the eigenvalue E;(1) is bounded from below by pmin, that is, 


Hm (8.14) 


To observe an eigenstate of Нұһ for 
the eigenvalue E;(1) at time tin, 
P 4 if system was in an eigenstate |Ej) > > рап. 
of Hini for the eigenvalue E;(0) at 
time tini 


Proof This is a direct consequence of Corollary 8.3 since the success-probability in 
question is given by | |P;(1)Ur( 1)ж;| |? and satisfies 


jq gu) V 
||P;(1)Ur (1) )| | > 1— ( т ) > рип: 
(8.9) (8.14) 
We recall from (G.45) that C;(1) is given as 
s | 2 

айрый, [| ү, n (eren „ш Г. eas 
(1) = + +/ + и. (8. 
: gy &(0? Jo | gu)? gj(u 


In many versions of the Adiabatic Theorem quoted in the literature [33, 112, 113] 
this expression for C;(1) is further simplified by using 
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£j.min ‘= ш tenes (8.16) 
and | | 
|н „= mes (lol 


to obtain an upper bound on C;(1). As we shall see when considering the adia- 
batic quantum search in Sect. 8.4, this may be too generous, and, instead, making 


use of more explicit expressions for || Hr) | ; || Hr (s) 


| and gj(s) can give much 


improved bounds for C;(1). 


8.3 Generic Adiabatic Algorithm 


How can the results of the previous section be of help in solving problems via quan- 
tum computation? То see this, let us look at how an algorithm based on adiabatic 
time evolution can be utilized to solve a problem, the solution of which is given by 
some state |Ҹ,) in some HILBERT space Н. For example, the solution of our prob- 
lem may be some natural number x < 2” for some n € N. Then it could be obtained 
by devising a solution-algorithm that finds the corresponding computational basis 
state |х) € H = H”. 
For such problems we can describe a generic adiabatic algorithm as follows: 


Generic Adiabatic Algorithm 


Input: A problem for which the solution can be obtained through knowledge of 
a state |',) in some HILBERT space Н 

Step 1: Find a Hamiltonian Hg, such that the solution state |) is an eigenstate 
of Hgn for some eigenvalue Efn j, that is, |Ҹ;) є Eig (Нал, Ёва). Typi- 
cally, one chooses Eg; = Eno to be the lowest eigenvalue such that the 
solution is a ground state of Hgn 

Step 2: Find a Hamiltonian Н for which an eigenstate | Фу ;) with the same j 
as in Step 1 is known and can easily be prepared 

Step3: Find a time dependent Hamiltonian H(t) such that 


H (tint) = Hini 
H (tin) = Нап 
and Hr(s) = Н(їи + sT), where T = tfn — fini, satisfies the Adiabatic 
Assumption (AA) 
Step 4: Prepare the quantum system in the initial state | Фу " at time fini 


Step 5: Evolve the system from time tini for a period of length T until tg; with 
the time evolution U (t, tini) generated by H(t) according to (8.2) 
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Step 6: Observe the final state 
U (tin, Аа) Фу) = От(1)|Фи у). 


From Corollary 8.3 we know that the probability to find a state in 
түү? 
Eig (Нал, Efin,) ) is bounded from below by 1 — (52) 
Output: A solution state |'%) € Eig (Нал, Efn j) with a probability of at least 1 — 


(P) 


From this algorithm we see that we can increase the probability of finding our 
desired solution state |) by increasing T, which is akin to performing the time evo- 
lution more slowly. One might be tempted to think that by making Т large enough 
we could bring our success-probability arbitrarily close to 1. The reason that this 
does not work is that we cannot isolate quantum systems an arbitrarily large time 
from its environment, and the natural decoherence time puts a limit on how large we 
can make T. 

Another way, however, to increase the success-probability is to make C;(1) as 
small as possible. From (8.15) we see that one way to contribute to this is by choos- 
ing the eigenvalue E; with the largest gap g;. Typically, this is the lowest eigenvalue 
Eisi 9 Of Hini, and the corresponding eigenstate is its ground state. 

From (8.15) we also see that another way to decrease C;(1) consists of finding a 


time dependent Ну (5) such that || Hz] and || Hr) 


ing down the transition will inevitably increase T'. 


| are small. However, slow- 


Definition 8.5 If in an adiabatic algorithm t к> H(f) is a convex combination 
of Hini and Hg, such that it results in 


Hr(s) = (1 — f (s))Hini +f (s)Hin , (8.17) 
where f : [0, 1] — [0, 1] is at least twice differentiable with f > 0 and satis- 


fies f (0) = 0 as well as f (1) = 1, then the function f is called the adiabatic 
schedule of the adiabatic algorithm. 


If Hr(s) is a convex combination of the initial Н: and the final На, then 


reducing | 


Hr(s) | апа || Hz (s) | means finding an optimal schedule f (s). In The- 


orem 8.16 in Sect. 8.4 we will encounter an example where the gap g;(s) is known 
explicitly and where we can then optimize the schedule f (s) to attain a small C;(1). 
The following corollary gives a general expression for C;(s) in the case of a convex 
combination. 
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Corollary 8.6 Let Hz (5) be a convex combination of Hini, Hg, € Bsd H) of 
the form 
Hr(s) = (1 —f(s)) Hini + f (8) На (8.18) 


with adiabatic schedule f : [0,1] — [0, 1]. Then C;(s) for s € [0, 1] as defined 
in Theorem G.15 and used in Corollaries 8.3 and 8.4 is given by 


f(s) , f(0) 
ao? gy (8.19) 


C(s) = || yin = Н 


+f POl iom- nul EO | 


gj(u)? gu)’ 


and an upper bound for it can be given by replacing | | [дє = М | in (8.19) 
by ||Hyin|| 11941. 


Proof From (8.18) it follows that 


Hrs) =/(5)(На — Ны) and Hr) = f(s) (Hin — Ны). 
Using f > 0, we thus obtain 


|| Hr) Інь, — Hail - 


| =) [IHin — Hinill and |Н (ә) 


E 


The claim (8.19) then follows by inserting these expressions for the norms of 
the derivatives into (G.45), and the last statement in Corollary 8.6 follows from 
(2.53). 


Since it is notoriously difficult to obtain the explicit form of g;(s), it may be 
necessary to replace it by a lower bound, such as its minimum as defined in (8.16) 
if at least that can be found. 

It may happen that, although we can specify and (hopefully) implement a time 
dependent Hamiltonian H(-) starting at Hini and ending at Hg, the eigenvalues Е;(-) 
along its path do not satisfy the Adiabatic Assumption (AA) on the full HILBERT 
space H. Hence, the preconditions of the Adiabatic Theorem G.15 would not be 
satisfied. 
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If, however, the Adiabatic Assumption (AA) is satisfied on a subspace Hsub C H 
and if H(-) leaves this subspace invariant, then we can apply Theorem G.15 and its 
Corollaries 8.3, 8.4 and 8.6 to the reduced setup, in other words, consider only the 
restriction of H(-) to Hur. 

Before we encounter such a situation in the context of the adiabatic search algo- 
rithm, we make the above statements more precise with the following lemma, which 
shows that if H(-) maps vectors of Hyp into Hiis, then the time evolution generated 
by H(-) does too. This lemma will be useful in the construction of an adiabatic 
version of GROVER’s search algorithm to which we turn in Sect. 8.4. 


Lemma 8.7 Let Н: [fini, tin] = BsdH) be a time-dependent Hamiltonian 
which generates the time evolution U such that 


.d 
1-00, Faa) = ENON b) 


(UA gs ta) = 1. 


(8.20) 
Moreover, let Hy, C H be a subspace of H and Psy the projection onto this 
subspace. If Psy is such that for all t € |tini, tin] we have 

[H(t), Psub] zx (0). (8.21) 


then 
U(t, tini) { Нуль} C Hsub 


holds for t € [tini, tg]. 


Proof The claim is proven, if we can show that 
U(t, fini) PsubU (t, lini) = Psub (8.22) 


holds for allt € [fini tîn]. This is because (8.22) implies U (t, tini )Psub = PsubU (t, tini ) 
and thus for апу |) € Hyup 


U(t, tini) | V) = U (t, tini) Psup | V^) = PU (t, tini) |P) Є Hisu, . 


From (8.20) we see that (8.22) is obviously true for t = tini. To show that it holds 
for every t Є [tini, tin], we show that the left side of (8.22) is constant: 
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d * 
=; Ut. tsi) РАБО (t, fini) ) 
dU (t, fini)“ dU (t, fii) 
dt dt 
i(U (t, tii)" H(t)PsubU (t, tini) — U (t, tini)“ PsubH (t)U (t, tini) ) 


Pog (t, fini) + U(t, lii) Psub 


iU (t, tini)” [H(t), Psub] U (t, tini) 


— 0, 
(8.21) 


which completes the proof of (8.22). 


Before we turn to the adiabatic search, we illustrate how the adiabatic method 
may be used to solve commonly occurring quadratic binary optimization problems. 


Definition 8.8 (QUBO) A Quadratic Unconstrained Binary Optimiza- 
tion (QUBO) problem is defined as follows: for n € N and a given Q € 
Mat(nx,n, R) find the extremum of the function 


B: {0, 1)" — R 
(xo, Е OE E xcu . 


Example 8.9 As an example of how the adiabatic method might be applied to solve 
a QUBO minimization problem for 


п—1 
B(x) = В(хо,...,хи-1) = m x; € {0,1} (8.23) 
ij—0 
with a given Q € Mat(n x n, R), we consider the Hamiltonian 
Hr(s) = (1 — f (s)) Hii + f (s) Нь 


on *H?", where f : [0, 1] — [0, 1] is an adiabatic schedule as given in Definition 8.5. 
To find the minimum for B, we choose the initial and final Hamiltonians as 
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п—1 


Ни = - У, х] 


п 1 п—1 (8.24) 
Hin = V, KX! + У ЛХ) + c1?" 
j=0 ij=0 
izj 


with x as defined in Definition 5.35 and 


1 m 
Ji = 400 for i Æj 


172 1 1 
Kj = – 4 2, (Qi + Qi) - 50j 
i=0 
{зү (8.25) 
_1 п—1 1" 1 

рә Оя + 5 р? Оў. 

ij=0 

2 

Recall that о; |0) = |0) and с; |1) = —|1), which we can write succinctly as 


б; |ху) = (1 — 2ху)|ху) for x; € {0,1} 
such that for any computational basis vector |x) = |x, 1... xo) € "IH?" we have 


|х) = (1 — 2x;)|x} . (8.26) 


Exercise 8.96 Show that Н as given in (8.24) has the eigenvalues 
Eini = =п + 21 forl € {0, m n) 


with degeneracy d; — ( ) such that its lowest eigenvalue Eini 9 = —n is non-degene- 
rate and its ground state is given by 


|p) = |11...1) = [^ — 1). 


For a solution see Solution 8.96. 
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The result of Exercise 8.96 shows that the ground state of His; is easy to prepare. 
The result of the next exercise shows that the computational basis states {|x) | x € 
No, x < 2") of TH®” are the eigenstates of Hg, with the eigenvalues given by B(x). 


Exercise 8.97 Show that for Hg, as given in (8.24) and (8.25) and B as given in 
(8.23) any computational basis state |x) = |x, 1... xo) € "IH?" satisfies 


Han|x) = В(х)|х). (8.27) 


For a solution see Solution 8.97. 


We can thus easily prepare the system in the initial ground state |®ini9) = |11...1) 
of Нт(0) = Hini and then subject the system to the time evolution generated by 
Hr(s) for s = 0 — s = 1. Provided that the Adiabatic Assumption (AA) is satis- 
fied, Corollary 8.4 tells us that if T satisfies (8.14), the system will end up in the 
ground state, that is, the eigenstate with the lowest eigenvalue of Hr (1) = Ну, with 
a probability of at least pmin. From (8.27) we see that this is the lowest possible value 
of B(x). Hence, observing the time-evolved state Ur(1)| Фо) will reveal a solution 
of the QUBO minimization problem with a probability of at least рь. 


8.4 Adiabatic Quantum Search 


We illustrate the adiabatic method by using it for the search problem which we dealt 
with in the GROVER algorithm in Sect. 6.9. This means that we are trying to find 
one of m elements of S, which is the set of ‘solutions’, by the adiabatic method [111, 
113, 114]. In other words, we are trying to find an 

x€Sc10, L...,N—1], 


where N — 2". For the adiabatic search we initially prepare the system in the state 
1 N-1 
№) = — У, |) € 'H” = H, 
N x=0 


which is the eigenstate for the eigenvalue 0 of the initial Hamiltonian operator 
Hini = 1 — |V6) (6| . 


For all vectors |Ҹ) € Hy): orthogonal to |Ч) we have 
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Hini|¥) = |Ҹ), 


that is, they are eigenvectors of Hini with eigenvalue 1. Whereas the eigenspace 
for the eigenvalue 0 is one-dimensional and spanned by |), the eigenspace for 
the eigenvalue 1 is (N — 1)-dimensional and given by the orthogonal comple- 
ment of |o). 

The final Hamiltonian Hg, of our adiabatic search is given by 


Hin = 1— Ps, 


where Ps is defined in (6.137) as the projection onto the subspace spanned by basis 
vectors |x) of the objects x € S we are searching for. Note that 


ч) = = Y 


xES 


as an equal superposition of all solution states is in the subspace onto which Ps 
projects. 
With S and S+ as defined in Definition 6.22, S is assumed to have m elements, 
and since 
Нап |х) = 0 Wee 9, 


the eigenspace of Hg, for the eigenvalue 0 is m-fold degenerate. On the other hand, 
we have 


Нь |х) = |x) — Ps|x) Ix) Wrest, 


Z 
6.137) 


= 


which means that На, also has 1 as an eigenvalue and that the eigenspace of Hg; for 
this eigenvalue 1 is spanned by the N — m computational basis vectors |x) for which 
x € 5+. Hence, the eigenvalue 1 of Hg is (№ — m)-fold degenerate. 


Definition 8.10 Let N = 2" — 1 and m € N with m < М. An adiabatic search 
algorithm for the search of m objects (aka ‘solutions’) x € S С {0,...,N — 
1} consists of subjecting a system in H :— HE” between the times tini and 
tin = fini + T to the time evolution generated by the time dependent Hamil- 
tonian 


H(t) = Hr (==) = \ = (=) Hini +f (==) Ilia c 


where f[0, 1] — [0,1] is an adiabatic schedule of the time evolution. We 
define 
Hini := 1 — |0) (| (8.28) 
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with 
1 N-1 
М) = — Y Gl eH (8.29) 
W 2 
as the initial and 
Hg, := 1— Pg (8.30) 
with 
Ps = У p) (8.31) 
xES 


as the final Hamiltonian of the adiabatic search algorithm. 


Since we are only interested in the time evolution between tini and tfn, it is more 
convenient to work with the rescaled Hamiltonian as defined in (8.4), that is, 


Hr (s) = H(fini + 5T) = (1 — f (s)) Hii +f (s)H&a , (8.32) 


where s € [0, 1]. 


Exercise 8.98 Show that Hini, Hg; and Ну (s) are all self-adjoint and positive. 


For a solution see Solution 8.98. 


Theorem 8.11 The eigenvalues and eigenspaces of the Hamiltonian Hr (s) 
of an adiabatic search algorithm with schedule f for the search of m solutions 
in N = 2" objects can be characterized as follows: 


(i) Hr (0) has 


(a) an eigenvalue E_(0) = 0, which is non-degenerate with eigenstate 
spanned by |‘) 

(b) and an eigenvalue Е (0) = E; (0) = Е,(0) = 1, which is N — 1 fold 
degenerate 


(ii) Hr(s) for s Є]0, 1| has 


(a) two distinct non-degenerate eigenvalues E+ (5) 
(b) an eigenvalue E,(s), which is (m — 1)-fold degenerate 
(c) an eigenvalue E»(s), which is (N — m — 1)-fold degenerate 
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Proof To begin with, we have for Hr (s) that 


Hr(s) =, (1—/())Ни + (8) Hin 
(8.5) 
= 0-fG) - (90) 0%) +F(s) (1 — Ps) 
(8.28),(8.30) 


1— (1 —f(s)) |) Ho] — f (s)Ps - (8.34) 


As before, let |Ø; „(5)), where œ € {1,...,d;}, denote the eigenvectors of Hr(s) 
for the eigenvalue E;(s), that is, 


Нт(в)|Фуе(5)) = Ел(8)1Ф,о (5) - (8.35) 


These can be expressed in the computational basis {|x) | x € (0,..., N — 1}} (see 
Sect. 3.2.2) in Н with the help of their components Фу „ (s), € C as 


N-1 
I5; „(5)) = У, Фу оа (5) |х). (8.36) 
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Hence, 
Hr(s)|®a(s)) =, 1Фа(8)) — (1 —F(s)) 190) Ф (5)) 

(8.34) 
— f (s)Ps|®j,a(s)) 
Y. (еа). - (1-£(6)) (95) bd 

= 7, 0KS) x — —J (5)) — (£0| Pj o (s x 

(829,835, i-r VN 

(8.36) 

— f(s) 29 о(ѕ) |х), 


and the eigenvalue equation (8.35) implies 


(156) 600) Dal) = E (9) Vres (837) 


(1— Е,())Фу (з), = 1 A (Ф; „(5)) VxeS-. (838) 


We distinguish the three cases listed in the theorem, and in the case 0 < s < 1 we 
consider first the subcase (|; ,(s)) = 0 and then (Ф; „(5)) 4 0. 


(i) First, let s = 0. In this case Definition 8.5 of a schedule implies f (0) = 0 and 
thus (8.34) gives 
Hr(0) = 1 — |") (6| 


from which it follows that 


Hr (0)|%) = 0 
Hr(O)|P) = |P) VY) € Hy) 


Hence, Нт(0) has the eigenvalues 0 and 1. The eigenspace for 0 is one- 
dimensional and spanned by |). The eigenspace for the eigenvalue 1 con- 
sists of the orthogonal complement Ну of |Ҹ). This forms an (N — 1)- 
dimensional subspace of H and the eigenvalue 1 is thus (N — 1)-fold degen- 
erate. 

(ii) Next, let s €]0, 1[. If (%|® „()) = 0, then (8.37) and (8.38) become 


(1—-f(s) — Е(5)) Ф; (5), =0 VxeS (8.39) 
(1- Е(5)) Ф; (5); = 0 Vee St, (8.40) 


which allow two solutions for the eigenvalues. The first is 


424 
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Since f (s) Z 0 for s Є]0, 1[, it follows that 1 — Е (5) # 0 and (8.40) implies 
=0 


D als)x for all x € S+. Hence, the eigenvectors for the eigenvalue Ej (5) 
satisfy 
[Pi a(s)) = У Фа(5)|х). (841) 
xes 


Since the set S has m elements, the subspace Span { х) | xE S} is m-dimensional. 
However, the eigenvectors also have to satisfy the starting assumption of this 
subcase, namely (Фу „(5)) = 0, which together with (8.29) and (8.41) trans- 


lates to 
* Dials) = 0 


xeS 


and reduces the dimension by 1. Consequently, the eigenspace of the eigenvalue 
E, (s) is the (m — 1)-dimensional subspace Span { |х) | xeSin Hii. 
The other solution for the eigenvalue implied by (8.39) and (8.40) is 


E»(s) = 1. 


Then it follows from (8.39) and f (s) Z 0 for s Є]0, 1[ that Ф o (s); = O for all 
x € S. Therefore, the eigenvectors for the eigenvalue E»(s) satisfy 


|Ф› 4 (s)) = у Dy «(5)х|х). 


xeg- 


Since the set S^ has N — m elements, the subspace Span { |x) | xE S+} is 
(N — m)-dimensional. As before, the eigenvectors also have to satisfy the start- 
ing assumption of this subcase, that is, (¥0|®2,a(s)} = 0, which reduces the 
dimension by 1. Consequently, the eigenspace of the eigenvalue E2(s) is the 
(N — m — 1)-dimensional subspace Span { |х) | xeSt}n Нуу: 

If, instead (%0|Ф; „(0)) 5 0, we first observe that since f is injective on [0, 1] 
and f (1) = 1, it follows that 1 — f (s) 4 0 for Є]0, 1[. Consequently, (8.37) and 


(8.38) imply 
(1 — f(s) — E()) (1 — E(s)) #0 


and thus 
ло) ү 
Balh = лг cgi al) ves 
Dal) = — 6) (Hlal) vee St 


ММ (1 — Ej(s)) 
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such that 
(Holdes) LS os) 
Ф; а (5 =: E Фу о(5)х 
29839 VN у= 
(1 —/(5)) (26/45 ()) 1 1 
N 2-70-56 * 21-609 
_ (1 -fG) (1616; () ( m ү Nam ) 
E N I-f()-E() * 1-55) 
Since the starting assumption in this subcase is (¥0|®; „(5)) # 0, it follows that 
1=(1- 2 ке | 8.42 
089) (aan tae):  ®® 


where m = x. The solutions of (8.42) for Е;(5) are 


Ex(s) = Lehar (е) 1). (8.43) 


Here we make use of the claim about the ordering of E;(s) forj € {—,1,+, 2}, 
which is to be shown in Exercise 8.99. 


Exercise 8.99 Show that for s €]0, 1| 


E_(s) < Ei(s) < Ex(s) < Ex(s). 


For a solution see Solution 8.99. 


Hence, Е! (s), E2(s) and Еу (5) are four distinct eigenvalues and since we know 
already that 
dim Eig(Hr(s), Ei(s)) =m—1 


dim Eig (Hr(s), E»(s)) = N —m— 1, 
it follows that Е (s) and E_(s) are each eigenvalues with one-dimensional eigen- 


spaces. We can thus drop the degeneracy index œ, and the components of ће asso- 
ciated eigenvectors |. (s)) are given by 
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(5 = 1 —f(s) pps. Vx S 
Ф: ( Jx vN (1 — f(s) — Ex(s)) (| D+ ( )) € 
_ 1—/(5) С x 4 
Ф} (s), mE УМ (1 NE Ex(s)) (466. ( )) V. € 5 


with E+ (5) as given in (8.43). With the help of the vectors |У) and | V.) defined 
in (6.138) we can write the eigenvectors as 


Ф. (s)) = ax(s)] 51) + b= (s)| V) , (8.44) 
where 5 
aite E БЕ F0 in y 
(1 — Ex(s)) (845) 
LL Vii(1- f) | | 
bs(s) = (1 —F(s) — Ex(s)) (%|Ф. ( )) * 


(iii) Finally, let s = 1. From Definition 8.5 we know that a schedule function f has 
to satisfy /(1) = 1. Hence, (8.34) gives 


Hr(1) 2 1— Pg. 


Consequently, Hr(1) has the two eigenvalues 0 and 1. The former has the 
eigenspace Ps {H}, which has dimension m. The eigenspace for the eigenvalue 


lis Pai {Н} = (psa) and has dimension N — m. 


Recall from Proposition 6.28 that in GROVER’s search algorithm the states after 
the jth step 
|'%) = cos Ө;|Ч 1) + sin Ө;|Ҹ5) 


are obtained from the initial state 


1 N-1 = = 
|) = — Y |х) = v1- mE) + Vin|%) (8.46) 
VN x=0 
(6.138) 
by rotating in the subspace 
Нуль := Span { |51), |Ҹ)} (8.47) 


by an angle Ө; = (2j + 1)Ө0, where 


Өр = arcsin @ = arcsin (Ут). 
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In the adiabatic version of the search algorithm we have a very similar situation as 
the following corollary shows. 


Corollary 8.12 Let Ну (-) be the time-rescaled adiabatic Hamiltonian of the 
search algorithm for the search of m solutions x € S C {0,...,N — 1} as 
defined in Definition 8.10. Moreover, define 


Өр := arcsin (Vim) € [0, > (8.48) 
апа " 
ee (5)) := cos O(s)|%i) + sin O(s)|%) Qo) 
|Ð (5)) := sin Ө(5)|Ҹ5:) — cos 0(s)| V5) , 
where 
1—E_(s) л 
3o IR (ta J Ep tan ө) Еа | fors € o (8.50) 
lim, 7; 0(s) fors=1. 
Then we have 0(0) = Ө) and Ө(1) = 5 as well as for s € [0, 1] 
|®..(s)) € Eig (Hr(s), Ex(s)) . (8.51) 


Proof To begin with, note that the definition of |Ч% 1) and |У5) in (6.138) implies 
(51 |95) = 0. It then follows from (8.49) that also (Ф, (s). (s)) = 0 for all s € 
(0, 1]. 

First, consider s = 0 for which we have f (0) = 0 = E_(0) and thus 0(0) = 6o 
such that 


|Ф_(0)) = cos @|%1) + sin Ө) = V1 —m|%.) + У) = | 
(8.49) (8.48) (8.46) 


) ? 


and we know from (i) in Theorem 8.11 that |Ҹ) є Eig (Н7(0), E- (0)). This proves 

(8.51) for |Ф_(0)). Moreover, (i) in Theorem 8.11 also states that Е (0) is non- 

degenerate and E (0) is (№ — 1)-fold degenerate. Hence, any vector orthogonal to 

Eig (Hr (0), E- (0)) is an eigenvector of Е, (0), which proves (8.51) for ІФ, (0)). 
For s Є]0, 1| we recall from (8.44) that 


|Ф+ (s)) = ax (s) S.) + b+(s)|¥5) (8.52) 
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with ax(s) and Б+ (з) as given in (8.45). The latter shows that a+(s) and р (эз) 
have the same complex phase, which we denote by w(s). This, together with 
(5:146) = 0 and |||? = ||%.||? = ||. (s)]? = 1, implies that we can write 
à. (s) and р. (5) in the form 


a(s) = e?*) сов Ө: (5) and Б. (х) = e+") sin Ө. (s). 


Using this and the fact that eigenvectors for different eigenvalues are orthogonal, we 
obtain 


= e(o- ()-0()) (cos 0, (s) cos 0. (s) + sin Ө. (s) sin 0. (s)) 
= ei(@-(s)-01(s)) cos (0. (5) = 6_(s)) А 


Ө, (з) = 0 (s) E Qk + D7 


(8.53) 


such that (8.52) gives 
|D_(s)) = е'®-@)( cos 0(s)| V5.) + зїп Ө(5)|Ч%)) € Eig (Hr(s), Е_(5)). 
It follows that 


|. (s) = eos 0(s)| si) + sin Ө(5)|Ч%) = е-!®-©)|Ф_(з)у) є Eig (Hr(s), E-(s)) , 
(8.49) 


proving (8.51) for ІФ (s), where s €]0, Ц. We will show below that Ө(5) has the 
form given in (8.50). Noting that the choice 0(s) = 0. (s) implies 


cos 0, (s) = cos (ec) + (2k + 7) = x (— 1 sin Ө(5) 


sin Ө, (s) = sin (ec) + (2k +1) ) = +(—-1) cos Ө(), 
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we therefore also obtain 


a, (s) = е'®+) cos Ө, (s) = x: (— 1)*el9* sin Ө(5) 
= gi ls) sin Ө(5) 
ba (з) = е'®+©) sin, (s) = +(—1)*e!?+ cos O(s) 


= —e!+() cos Ө(з), 


(8.54) 


where @, is such that =(—1)*ei@+ (s) = gi. (5). Using (8.54) in (8.52) gives 


(o, (5)) = el? (9) ( sin Ө(5)|Ҹ5:) — cos Ө()|Ҹ5)) € Eig (Hr(s), E+(s)) , 
which implies 


|, (s)) = sin 0(s)|%1) — cos Ө(з)|'%) = e+) |e, (s) € Eig (Hr(s), Е, (3) 
(8.49) 


and proves (8.51) for |®,(s)), where s €]0, Ц. 
Before we consider the case s — 1, we prove (8.50). We know already that 
0(0) = Өр. For s €]0, 1| we have 


tanO(s) = b_(s) = 1 — E (s) vm 
ча (8) Se Vf) - E-() УТ т 
ro аа, dus 
din 1 —f(s) — Е (s) 


and we have thus verified (8.50) for s € [0, 1]. 

As for s = 1, we know that f (1) = 1 and from (8.33) that E (1) = 0. To show 
that then (8.50) implies 0(1) = 5, it suffices to note that tan Ө) > 0 and to use the 
result of the following exercise when considering the lim, 7; of the right side of 
(8.55). 


Exercise 8.100 Show that 0 < f(s) < 1 implies 


1—f(s) - E-(s) 20. 


For a solution see Solution 8.100. 
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It follows that then lim, 7; tan @(s) = +% and thus 0(1) = 5. With this the claims 
(8.51) for s — 1 take the form 


|_(1)) = 195) € Eig (Hr (1), E-(1)) 
(8.49) 

|Ф(1)) = |.) € Big (Hr(1),£+(1)), 
(8.49) 


which we know to be true since | 5) is an eigenvector of Hr(1) = Hgn = 1 — Ps 
with eigenvalue E (1) = 0, and |V51) is an eigenvector for the eigenvalue E, (1) = 
1. 


Corollary 8.12 essentially states that the adiabatic time evolution Up (-) generated 
by the Hamiltonian Hz (-) rotates the initial state |%) within the two-dimensional 
subspace Hsub to the state |5), which is an equally weighted superposition of all 
solution basis states |x), where x € S. 

Let us briefly summarize what we have learned of the adiabatic search algorithm 
so far: among the eigenvalues of Hr(s) we have E+ (s), which satisfy 0 < E- (5) < 
Е. (s) < 1, and their eigenspaces are contained in Hsu = Span 4 |), |%u) ). 

From Lemma 8.7 we know that if Hz(s) leaves Hsu» invariant, then this is also 
true for the time evolution it generates. In this case we can then apply the adiabatic 
estimates of Corollaries 8.3 and 8.4 to the two-dimensional problem in Hsup. As the 
following lemma shows, Hr(s) for the adiabatic search indeed leaves the subspace 
Hub invariant. 


Lemma 8.13 For Ну (5) as defined in (8.32) and Hsu as defined in (8.47) we 
have for all s € [0, 1] that 


[Hr (5), Psub] =0. (8.56) 


Proof As we have already seen in (8.34), Hr(s) can be written as 


Hr(s) = 1— (1—f(s)) |) (| — f (s)Ps , (8.57) 
where 
Ps = Y pil. (8.58) 
xeS 


From (8.46) we obtain 


(Po) “| = (1 — m)| Ps1) (Poi | + т) (56| 
+ /m(1 — т) (|95) (96| + 146) (15s |). (8.59) 
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On the other hand, since Hsub = Span { Fs), [V51) үй the projector onto this sub- 
space is given by 

Pouw = |5) (|+ [8:0] (8.60) 
such that together with (8.59) we evidently have 


0) (Рл = |) (V 6| = Psub |o) (6| (8.61) 


and thus 
[1 — (1 =f (s)) (P0) Po], Psub] = 0. (8.62) 


Moreover, we find 
PsPsub “=, (z но) CIKA sr 1) (I5. |) 
(8.58),(8.60) VES 


= \\)(Ч6| = Р.Р. (8.63) 


Hence, 
СРЕ Psub] =0, 


and together with (8.62) and (8.57) this proves the claim (8.56). 


As а consequence of Lemmas 8.7 and 8.13 we can now restrict all considerations 
to the subspace Нуль since it is in this subspace where the initial state |) at tini 
resides and where we remain until tj, = tini + T. This means that instead of Hr we 
only need to consider its restriction to the subspace Hyp 


Hr(s) 


Hut = PsubHr(s) Руль, (8.64) 


where Р,ць is as given in (8.60) and when multiplying Hr(s) on the right is viewed 
as an operator Р;ць : Hsub — H, whereas when multiplying on the left as Psy, : Н — 
Hub. Because of (8.56) and Pr. = Pp we also have 


PsubHr(s)Poub = PsubHr(s) = Hr(s)Psub , 


but the right side of (8.64) is more suggestive of the fact that we are dealing with an 
operator on lH only. 


Exercise 8.101 Show that for s € [0, 1] 


Hr(s) 


a, | ®x(s)) = Ex (S). () 


such that the spectrum of Ну (s), when restricted to Hyp, is given by 
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c (Hr(s) 


- = {Ex(s)}. (8.65) 


For a solution see Solution 8.101. 


Note that Hub being two-dimensional implies that the two distinct eigenvalues 
Ex(s) of Hr (в) |. , аге non-degenerate. Consequently, we only need to consider 


the eigenvalues Е. (s) and the eigenstates |. (х)) of Hr(s). From Theorem (8.11) 
we know that E (s) is the lower of these and it is also the eigenvalue which has the 
initial state |) as its eigenstate at s = 0. 

Corollary 8.4 tells us that if we want to find the eigenstate |Ф_(1)) = |Ч%) of 
E. (1)—and thus a solution searched for—with a minimal probability pmin, then the 
transition time T has to satisfy 


jut. 
vl — Pmin 
In order to know how T grows for N — оо, or equivalently m = у — 0, we thus 


need to determine the growth of C_(1) as a function of m — 0. 
From Corollary 8.6 we see that C. (1) is determined by ||Hfn — Hini|| and the 
functions g.. and f. The value of the first of these three is given in Exercise 8.102. 


Exercise 8.102 Let Hin; and Hg; be as defined in Definition 8.10, and let Р,ць be as 
in (8.60). Show that then 


= (8.66) 


|| (Hin — Hini) liz 


For a solution see Solution 8.102. 


This determines one ingredient of C- (1). Before we consider the schedule f in more 
detail below, let us have a look at the gap function g_(s). From Definition G.4 of the 
gap function we see that for the eigenvalue E- (s) of the reduced operator Ну (s 
itis given by 


) | Hub 


g_(s) = min { |E;(s) — E_(s)| | Ej € c (Hr(s) |; „) \ {E_(s)}} 
(G.8) 
= Ex(s) - E.G) 
(8.65) 
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With the help of the function 


g : [0,1] — [0,1] 


(8.67) 


The next proposition shows that if we choose a linear schedule f (s) = s, then we 
end up requiring a transition time T € 0(%) for N — оо if we want to guarantee to 
find the solution with a given minimal probability. This does not reflect the quadratic 
speedup seen in (6.161) for the circuit based version of GROVER'S search algorithm. 
As we shall see later, a more suitable choice of the schedule f allows us to replicate 
the efficiency of the GROVER’s search algorithm in the adiabatic setting. 


Proposition 8.14 In an adiabatic search with schedule f (s) = s the success- 
probability of finding a solution after the time evolution from tini to tin = 
tini + T can be bounded from below by Pmin €]0, 1| if 


TE о(^) for М — оо. (8.68) 
т 


Proof For the linear schedule f (s) = s we have g (s) = g(s) with g as defined in 
(8.67). Inserting this and the result (8.66) of Exercise 8.102 into (8.19) yields 


x 1 1 = [1 du 
csv fi (ap + дир t OVA f саяз], (8.69) 


where we have used that f(s) = 1 and f (s) = 0 for s € [0, 1]. Using 


J du Е 2(2au + b) 
(au? + bu + c)? (4ac — b?) vau? + bu + c ' 


we find 


A du -f du _ il 
o g(u) — ol 32 m 


m +4(1 — 8) (w— 4)°) 
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With this and g(1) = 1 = g(0) it follows from (8.69) that 


m 


- 1- 1 " 
ex adr ode о(5) for 0. 
т 


From Corollary 8.4 we know that іп order to ensure that the success-probability is 
no less than pmin, the transition time T must satisfy 


C. (1) 
Т > ————. 
B V 1 — Pmin 


Since m — x it follows that for N — ce 


T c 0(C (1) € o(.) | 


The result of Proposition 8.14 shows that using a linear schedule leads to a tran- 
sition time that is of the same order as the usual search, in other words, grows 
linearly with N. It turns out, however, that by judiciously choosing the schedule f 
we can improve on (8.68) to the extent that we indeed obtain the quadratic GROVER 


speedup T € O (v=) In order to show this, we need the following preparatory 
lemma [111]. 


Lemma 8.15 LetO < m < 1 and g : [0,1] — [0, 1] be such that 


s үя Pado) (« T (8.70) 


Then the following hold. 


(i) Fora € R witha > 1 we have 
1 ~ 1-а ЖУ, 
| «()у-“аєо(йт) — fori o. (8.71) 
0 
(ii) For b € R with 1 < b < 2 we have 


1 b-2 
f glu)’ > |g(u)| du € о(й'т) form — 0. (8.72) 
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Proof (i) In 


0 a/2 
(14d. - ) (u — 1) ) 
we substitute z = 2 x —1 (и — 1) such that 
1 -ad mo йз“ ME 
f абда = =н [Т a= m E E 
0 Ps = "m j^ 


1—a 


Ux E 


Here we can use that for a > 1 


———— = р < оо, 
о (14-22)? 


Hence, we have 


and thus 
1 ~ 1-а И 
n g(u) “аи € o(m*) for m — 0 
0 


as claimed. 
(iii) From (8.70) we find 


435 


436 
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Hence, using again g(1) — 1 — g(0) and g (5) — Vim, we obtain 


where we used the assumption 1 « 5 « 2 in the last inequality. Consequently, 


[ glu)’ |a(u)| du € o(m) for mi — 0 
0 


holds as claimed. 


The next theorem shows that if we suitably adapt the schedule f to the function 


2, we can indeed achieve T € o( P. 


N 


m |` 


Theorem 8.16 ([111]) Let0 <т = 5 < 1 апа g be defined as in Lemma 8.15. 
For 1 < b < 2 define 


il 
Kp := / pu) ш (8.73) 


and letf : [0, 1] — R be defined as the solution of the initial value problem 


: b 
| z pg (f(s) (8.74) 


Then the following hold. 


(i) f is a permissible schedule, in other words, it is a strictly increasing func- 
tion from |0, 1] onto itself satisfying f (0) = 0 and f (1) = 1. 


(ii) In the adiabatic search with schedule f we can guarantee to find a 


solution with a given minimal success-probability if the transition time 
T = tin — tini grows as 


TE Z0 for М — ee. (8.75) 
m 
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Proof Note that existence and uniqueness of a solution to (8.74) is guaranteed 
because the function y к> къё(у)” is LIPPSCHITZ-continuous [115]. 
(i) From its definition in (8.70) we see that g > 0, and thus (8.73) implies that 


Kp > 0 as well. It then follows from (8.74) that also f > 0. Hence, f is strictly 
increasing on [0, 1] and by its defining property (8.74) satisfies f(0) = 0. То 
show that also f (1) = 1, consider that in general 


fa) E 
/ g(u) "du = |: e(f (s y (8.76) 


‘f (1) 
f | g(u) ^ du S f: (( (s) у? Kpg (f (s Ne ds = к=, f (ш). 
),(8.76) 


Since g > 0, we must have f (1) = 1, and altogether f is a permissible schedule 
as it satisfies the requirements of Definition 8.5. 

(ii) From Corollary 8.4 we know that the transition time 7 needed to guarantee a 
success probability of at least pmin has to satisfy 


C.(1) 
м1 — Pmin | 


In order to ascertain the growth of T as a function of N, we thus need to examine 
C. (1) in this respect. Inserting the result of Exercise 8.102 into (8.19) yields 


С_(1) = A1 «(45 4 FO (8.78) 


T> (8.77) 


1 ш) 1 ру 
[Luder tovt | PW a 
o g-(u) 0 g-(u) 
We now consider each term in (8.78) in turn. Using first that per definition 


f(s) = кьв(/(з))” and g_(s) = &(/(5)) (8.79) 


together with f (0) = 0, f(1) = 1 and g(0) = 1 = g(1) yields 
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such that | 
1 0 
s + a = 2кр. (8.80) 
Next, consider that 
Fu) = SPW) = © (ww) = omer)” а) Q0) 
(8.74) 
= biis (FQ) &(/(и)) 
(8.74) 
Hence, we obtain 
ш) = bx Ew)” EFW), (8.81) 
and thus 
ГК Polu с Г SE NaF), 
о 8 (и)? disi БЕ 0 g(f (u)) 


1 
2b-3|. 
= bk? f g(f(u)) le (f (u)) | du. (8.82) 
In the last integral we make the substitution z = f (и), which implies 


dz = f (u)du, =, kyg (f (u)) du . (8.83) 
(8.74) 


Consequently, we have 


[Eo с. е [шешә а 


b 
(8.82),(8.83) Kpg(z) 
1 
= њ | g(3) ^ |g(z)| dz. (8.84) 


Lastly, consider 
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Making again the substitution z = f (и) and using (8.83) results in 


1 fu — І 3 dg 
hws =f 80” e 


1 
= / gas. (8.85) 


Inserting (8.80), (8.84) and (8.85) into (8.78) yields 


c-(1) = УТ — ins (2 + of (2^? |g(z)| dz + ovi =m f каа) 


(8.86) 


From the definition (8.73) of къ and Lemma 8.15 (i) we deduce that 
~ l-b z 
kp e О(й т) form — 0 


and thus 


У йке о(й т) for fi — 0. (8.87) 


From Lemma 8.15 (ii) we see that 


1 
b-3 |: ~ b-2 p 
f «o le(z)| dz, € o(m^^) form 0. (8.88) 
(8.72) 


Setting a — 3 — b, we find that then 1 « a « 2 and that Lemma 8.15 (1) implies 


1 1 " TE _ 
n 80) = | g(z) ^dz € o(m') = o(m^) form — 0 
" 9 (8.71) 

and thus 


1 b—2 p 
V1-— т | g(z)P dz є o(m7) for m — 0. (8.89) 
0 


Using (8.87)-(8.89) in (8.86) and applying the properties (C.1) and (C.2) of the 
LANDAU symbols, we finally have 


C.(1)€ о(йтй? ) = o(m 3) = Z0 form — 0. 


The claim (8.75) then follows from (8.77). 
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Fig. 8.2 Graph of functions g(s) of (8.70) with N = 210, т = 4 such that m = 2^? and f (s) of 
(8.74) for b — 3 


Figure 8.2 shows g(s) in the case m = 2^? together with a numerical solution 
f (s) of (8.74) for a schedule with b = 3. 

With the proof that the efficiency of the gate based search algorithm can be repli- 
cated by its adiabatic version we conclude our investigations of quantum adiabatic 
search algorithms, and we turn to the question of equivalence between gate based 
and adiabatic algorithms on a general level. First, we show that any gate based 
computation can be replicated with similar efficiency as an adiabatic computation, 
before we then show the reverse, namely, that any adiabatic quantum computation 
can be replicated with similar efficiency by a suitable gate based version. 


8.5 Replicating a Circuit Based by an Adiabatic 
Computation 


We consider the situation where we are given a circuit U which acts on п qubits and 
which is comprised of L gates U,, .. . , Uz, that is, 


U=U,::-Uj : H” —› HS”, 


where L is the length of the circuit U (see Definition 5.27). It helps to simplify the 
notation in subsequent expressions if we also use the trivial gate 


Up = 18” . 
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The circuit U is used to perform a quantum computation by transforming a given 
initial state | Чї) to a final output state 


|) = U in) . 


In this section we shall show that given any input state |Vf5;), the final output state 
|Win) can also be produced by means of a suitable adiabatic quantum computation 
with similar efficiency [34, 114]. Comparable efficiency here means that the transi- 
tion time Т in the adiabatic computation grows only polynomially in the length L of 
the circuit, namely that T € poly (L). 

How do we then go about constructing |an) = U |.) in the adiabatic com- 
putation? As we assume that we have |ni) at our disposal, we can construct 
Hini = 1 — |) (4| as the initial Hamiltonian that has |%,;) as its eigenstate. But 
we cannot do the same to construct the final Hamiltonian, since we do not have 
|Win) directly available to us.! 

However, we assume that we do have the gates U;,..., Ur of the circuit U at our 
disposal. The following Exercise 8.103 serves to illustrate the idea how to utilize the 
gates U; to construct |Yfn) in the adiabatic computation. 


Exercise 8.103 Let L € N, aj,..., aj € Rx (0) and let A € Mat((L+ 1) x (L+ 
1), R) be given as 


1 -(aq)! 0 0 
—a] 2 ~(az)7! 0 
0 -a 2  —-(a)! 
A= —aj-, 2 -(aj) ! 
-ajpa 2 -(a1)! 0 
—ap4 2 (а)! 
0 je 0 ар 1 


Show that A has the eigenvalue 0 with eigenvector 


‘Tf we had, then there would be no need to perform the adiabatic computation. 
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a241 
eo = | aj-1đj-2** -a241 | € RAH, 


ap-20L-3::: 020] 
ap-10pL-2:-: 020] 
apap-i:::d2d0] 


For a solution see Solution 8.103. 


In order to illustrate the idea underlying the replication of a gate based computa- 
tion with an adiabatic one, we use the result of Exercise 8.103 for the following 
analogy: imagine that in A we replace the a; with the operators U; of the gates of 
our circuit, and in e, we replace 1 with |Yhi) as well as a; with U1 |), and the 
remaining а; in eo are replaced again with the U;. What the claim of Exercise 8.103 
then would tell us is that the eigenstate eo of A for the eigenvalue 0 has in its last 
component Ur U; | +- |) = Ы|Ч ш), which is the final state |an) we are try- 
ing to construct. Hence, we would have identified the desired state |%n) as part of 
an eigenstate of an operator A which has been built by using the individual gates U; 
of our circuit U. This is the idea behind replicating a gate based quantum computa- 
tion with an adiabatic computation, where the role of A will be taken by a suitable 
Hamiltonian. The remainder of this section is devoted to making this more precise. 

In our analogy the jth component of eo is U;U; .; · · - U;| V.) and constitutes that 
state in the circuit after which the jth gate has been applied. Therefore, we interpret 
the basis states 


0 0 0 

І 0 0 
0 T 0 ? 1 " , 0 
0 0 0 І 


as the analogues of states of a computer clock advancing with each new gate that is 
applied in the circuit. A first ingredient required for the adiabatic equivalent is then 
the ‘clock’ or ‘counter’ space and its states. 
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Definition 8.17 Let L € N, and for l € (0,...,L) define 


c | if1-0 


xi OLD 


We define the clock space as НС :— HS% and the clock or counter states as 
the subset of the computational basis states given by 


|х@)) = [|Х(#ә-1...х(Фо) € HY, 


where 


0 if0<k<L-l 
A= TIS (8.90) 
Due pcd 1, 


Note that for / € {0,..., L} each |x(I)) is a basis vector of the computational 
basis and that 
х() = х(т) © 1=т 


as well as 
(x(Z)|x(m)) = бы. (8.91) 
Moreover, we have 
b) = 10...00, 0) =11 0...0), ..., 
L times 1—1 times 
_ = (8.92) 
Ix(D)) =|1...1 0...0), TES |x(L)) =|1...1). 
l times L—I times L times 


Since by Definition 8.17 
x(1 +1) =x) +271, 


we find that the difference between |x(/)) and |x(/ + 1)) is that only x(/)r 1 = 0 
changes to x(1 + 1); .;.1 = 1. Hence, stepping through the finite sequence (|x(0)), 
|x(1)),..., |x(L))) constitutes a GRAY-coded transition (see Definition 5.22). 

The reason that we chose the |x(/)) as the counter states in this form is that each 
‘time-step’, that is, ‘advancing the clock’ from |x(1)) to |x(/ + 1)) remains 3-local 
(see Definition 3.21). Had we chosen a simple counter, such as the computational 
basis states |0), |1), |2), ..., |2) in *H*" with J = |log, L| + 1, to count down time, 
then advancing the clock, for example from 
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J-2 
1—1 _ = j = 
|2 1) 12,2) |0 1...1), 


J—1 times 
by one step to the clock state 
2-5 =]1 0...0), 
м 
J—1 times 


would require the change of altogether J qubits. Hence, the clock Hamiltonian 
would have to be J-local and thus ultimately be O(log, L) local. 

Equipped with the clock states |x(/)), we proceed to define various other states 
which will be used to construct the adiabatic approximation to a given circuit [34]. 


Definition 8.18 Let U be a plain circuit of length L as defined in Defini- 
tion 5.27 acting on n qubits 

ВЕ 000 ешн) 
where we set Up := 1°” and each U; is 2-local. We call HY :— ‘H®” the 
circuit space. Let |¥%,;) := |0)" € НУ be the initial circuit state, and for 
1 € {0,...L} define the states 

[E(I)) := Uj--- U1Uo| Pri) ЄН. (8.93) 


In the combined circuit and clock system described by states in the combined 
circuit and clock space IH @ НС we define 


IF (1) := (E(D) ә k@) € HY @ H° (8.94) 
and 7 
e 1 U C 
r= TU 2 |Г(т)) € H” @ H°. (8.95) 


Exercise 8.104 Show that 


Ж (|| = 1 (8.96) 
(T (DIT (m)) = би. (8.97) 


For a solution see Solution 8.104. 
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From (8.94) and (8.97) we see that the {|I (m)) | m € {0,...,L}} are a set of 
orthonormal vectors in the combined circuit and clock space HY & НС. With their 
help we define the following subspace 


Huy := Span {|r (m)) | m € {0,...,L}} с Н” emt. (8.98) 


In order to construct an adiabatic quantum computation, we need to specify its initial 
and final Hamiltonian. This is done in the following rather lengthy definition [34]. 
The rationale behind the various terms will be given later after some of their prop- 
erties have been shown. 


Definition 8.19 For/ € {0,...,L} let U; be the gates of a circuit U of length 
L as in Definition 8.18. On the combined circuit and clock space HY @ НС 
we define the following Hamiltonians 


Hini :— He-ini Hinput Hclock (8.99) 
Нап == Нргор Hinput nicak E (8.100) 

where 
ыкп = on) а (8.101) 


n 
Hima = zs 197! e [| @ 1®”—7 @ |0)(0| @ 197! (8.102) 
Hetock = 19" @ У 1” ® |0) (01 ә |) |8 1977? — (8.103) 
i=0 
1 L 
Hprop :— 5 S Hr. (8.104) 


The H; in the propagation Hamiltonian Hprop are defined for the cases / = 1, 
1«l«Land! = Las follows: 


al = ji” ә (100) (00| + |10) (10]) (8.105) 
—U, & |10)(00| — Ux & (00) (10| & 19-2 

H; := [ое & (|100)(100| + |110) (110]) (8.106) 
= U; & 19? & |110) (100| — Uf & 19? @ |100) (110|| & 197-77! 


Hz := 19"? @ (|10) (10] + |11) (11) (8.107) 
— Ur & 19? @ |11)(10| — Uf @ 187? @ [10)(11|. 
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The reason for the particular form of Hprop comes from the illustrative results 
derived in Exercise 8.103. The discussion subsequent to that exercise shows that 
with Hprop as defined in Definition 8.19, we can expect to find the desired state 
Ur- - - 0 |Ж.) as a component of the ground state of Hg,. This will be confirmed 
in Theorem 8.23, where we show that |I), which is the analogue of eo in Exer- 
cise 8.103, is a ground state of Hfn. The rationale for the particular forms of 
Hc.ini; Hinput and Наоск Will be easier to explain with the proof of Lemma 8.20 in 
hand. 

It turns out that |I '(0)) is the ground state of Hini, in other words, it is an eigen- 
vector of Hini for the lowest possible eigenvector, which for Hini is zero. 


Lemma 8.20 The operators H¢-ini, Hinput; Hetock and Hini as defined in Defi- 
nition 8.19 are self-adjoint and positive. 

Moreover, the lowest eigenvalue of Hini is 0. This eigenvalue is non- 
degenerate and has |T (0)) = |0)" ® |0)* as an eigenvector, that is, Eig(Hini, 0) 
= $рап{|Г(0))}. 


Proof To begin with, we have, for example, 


1—2 ж 
Нек = (1% e $1? & (e [D (1 19) 
(8.103) 1-0 


= al o * GL-1—2 
= "erts (J040)* & (D) a)* @1 


1—2 
12" ® У 1% @ |0)(0| & [D) (1| 8 19? 
1=0 


= Helock : 
(8.103) 


Similarly, one shows that Н, and Hinpu are self-adjoint. Then Hini as a sum of 


self-adjoint operators is self-adjoint as well. 
To show their positivity, consider the computational basis (see Definition 3.8) 


vectors 
[9 = leni HE . Éo) = lei) 6.09 léo) Є HY 


with Ё = Y &j2), where £j € (0, 1}, and 


|х) = |xp_1...%0) = |xa-1) @ +++ 9 [xo) € HE 
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with x — 34 xj2/, where ху € (0,1). The set of vectors {|&) & |х) |o € £ < 
2",0<x< 2^ form an ONB in HY @ НС, and any vector |У) € HY @ НС can 
be written in the form 


2n—12L—1 


'#)= У, M 9.15) ә. 
€=0 x=0 


In the following we will often use that 
(015) =(1—&) and (16) = Gj (8.108) 


and likewise for |x;). Hence, we can write 


Heni (16) @ x) = (9 @ [1) 1] e 19 73)|5) 8 |ә) 
(8.101) 


I 


—Á 


|6) & |1) (1ху—1) ®|ху—2) 9 - -- Q |xo) 
xL-i|5) & |1) 8 |xz-2) 8 --- & |) 
xz_1|€) ® |x) (8.109) 


I 


such that for any |W) € HY @ НС 


(P|He ini?) = У У Mey Pe уху (|) (уг—1|1)(уг—ә[и.—2) «+ (уо|хо) 


VEX Мм 

буб =. ха 
= Y Y yx Pey Pex (уроо) 5 (уо|хо) 

Е ух анына аан 

—Ó 5.079 =буу, 
2 

= Y). [ЧЕ | 

Ex 
>0, (8.110) 


verifying the positivity of Н, і. Next, we consider 


Has (I) ® 9) = (X197 ә @ 197 е [0)(0] @ 1%") 6) ә D) 
(8.102) J=! 
Ww > En—j(1 — x6) 89:96 ju) 8 |1) ® [Sn-j-1) 
(8.108) =! 


S- 8 |G) 8 |0) & |xz-2) ® - ++ 9 |) (8.111) 
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such that for any |) € HY @ НС 


(Нь) = у Y pm me 7 — Xp 1) (5n ila 1) ona (б»—]+1|бл—+1) 


C eyxj-l 
x(G, ne j 1165 7 1) +++ (бо|бо) 
x (yz-1|0)(yz—2|xx-2) ° (уох) 


E 2 [Pex | i ORA бох , 


| H 


showing that Hinput is positive. Finally, we have 


1—2 
Hale) & р) =, (19 & У 1/10) ә у @ 1%) |) ә |») 
(8.103) 1=0 
1-2 
=, |8) е У (1-х aas) 8-9 x) 
(8.108) 1=0 
& |0) 8 |1) 8 |xr 1-3) 8 --- |х) (8.112) 


such that for any |) € HY @ НС 


CP [Heick P) =} b» LR б\ XL-1— TT 1-1 


é x 1=0 
1 (8.113) 


which proves the positivity of Hetock. AS a sum of positive operators, Hini is thus 
positive, too, and its lowest possible eigenvalue is zero. Since for |Г(0)) = |0)” & 
[0 all E and x; are zero, it follows from (8.99), (8.109), (8.111) and (8.112) that 
Hini |I (0)) = 0. 

To show that this is the only eigenvector for the eigenvalue zero, note that we 
have from (8.110)-(8.113) that for any |У) € IH" @ НС 


n L-2 
(P Hini P) = >. (вы + уу Ore, Oo F >, 81,12 9o 11 ) LO 
x ММ = = 


>0 Eee —————— 
>0 20 


Hence, for |F} to be an eigenvector of Hini for the eigenvalue zero, each term has 
to vanish. This means that first only ФЕ, for xj. = 0 can be non-zero. But then the 
middle sum implies that only "fe, with é; =0 = x-1, where 
j € (0,...,n — 1} can be non-zero, that is, the only possibly non-vanishing Fe 
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are of the form "f$, 9.0; »..«,. The last sum only vanishes, if out of these those for 
which 
хә = d and xp,,1-20 forle {0,...,L—2} 


vanish. Using this for / = 0 implies that the only possibly non-vanishing component 
of the eigenvector has to be of the form Ҹ. ооох з...хо: Using the same argument 
successively from / = 1 to | = L — 2, we find that the only non-vanishing compo- 
nent of an eigenvector |У) of Hini is %...0.0...0, hence, |3”) = et% |I (0)) as claimed. 


Our adiabatic replication of the circuit U evolves the ground state of Hini into a 
ground state of Hg, with a probability as described in Corollary 8.4. The rationale 
behind the form of Нели, Hinput and Heiock is to assure that the initial state |) = 
|0)” @ |0)* = |T (0)) is the ground state of Hini and that the ground state of Has 
is akin to eo in Exercise 8.103. This means in particular, that we want to start our 
adiabatic evolution in the starting clock state |x(0)) = |0)” and then let the ground 
state evolve only in the subspace of ‘legal’ clock states 


Н = Span {|х(/)) | t € {0,...,L}}. (8.114) 


This is achieved by designing He ini, Hinput and Наоск in such a way that they vanish 
on HE, and have eigenvalues no less than 1 on its orthogonal complement. From 
(8.112) we see that 


01 in binary form of x 


Haoa (|§) ® |х)) = ( 


count of appearances of sequences 
|6) 8 |x) 


and (8.92) together with (8.114) shows that Hetock (1) ® |x)) = 0 if and only if 
|x) € Hie: Similarly, we see from (8.111) that Hinpur({€) ® |x)) = 0 if and only 
if & = 0 for j € (0,...,n — 1} or if х = 1. Hence, for the initial clock state 
|х(0)) = [0)2 only |£) = |0)" yields Нь (|E) ® |x)) = 0, in other words, if the 
clock shows 0, the circuit state must be |0)" if the combined system is to be 
in a ground state of Hini. Finally, from (8.109) we see that Н, (5) & |x)) = 
xr 1|) Q |x) such that it vanishes if and only if хі = 0. But this together with 
the earlier requirement |х) € HE, implies that the ground state of Hini is |0)" & |0). 
This may suffice as a somewhat heuristic motivation for the constructions of the var- 
ious Hamiltonians in Definition 8.19. In the remainder of this section we proceed to 
show in more detail that the way these Hamiltonians are defined does indeed deliver 
the desired replication. 

Now that we have established in Lemma 8.20 that |I (0)) is indeed the unique 
(up to a phase, of course) eigenvector of the lowest eigenvalue of Hini, we study the 
properties of Hg. For this we first need to establish how the various terms in the Н; 
of Hprop act on the clock state vectors |x(m)), where m € {0,...L}. 
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Exercise 8.105 Show that for any clock state |x(m)) as defined in Definition 8.17 


and a, b € (0, 1} one has the following identities. 


(|a0) (0| & E spi) = 04,005,105, |x(m — 1)) 


D 4,195,095, 0| x(m + 1)) 
(17? & |1a0) (1b0|1°°"") |х(т)) = 54,065.15 x(m — 1)) 


+ 04,105,065, 1|x(m + 1)) 
(19272 ® |1a)(1b|) |x(m)) = б обьлб»л.|х(т — 1)) 


+ 64,165, 00m L1|x(m + 1)) . 


For a solution see Solution 8.105. 


(8.115) 


+ (82,05,05m,0 + 05,105,105) |x(m)) 


(8.116) 


+ (8.08081 + ба, 55,1 бы) |x(m)) 


(8.117) 


"E (0808-1 + баль A |x(m)) 


Next, we show that He. ini, Hinput, Hetock, Hy and thus Нор all leave Hsup as defined 


in (8.98) invariant. 


Lemma 8.21 For m € {0,...,L} let |I (m)) be as defined in Definition 8.18 
and He-ini, Hinput, Ноос and H; for l € {1, . . . , L} as defined in Definition 8. 19. 


Then the following hold. 
Н.Г (m)) = (1-8, 0)1Г(т)) 
Нлрш|Г(т)) = 0 
Hcc Г (m)) =0 
НГ (m)) = (ôn 1-1 F бы)|Г (m)) 


тр Oni (m + 1)) a ôn |I (m < 1)) о 


Proof We begin with the proof for (8.118). We have 


Нат) =, 18" & |1)(1| e 182-020) & |х(т)) 
(8.101) 


m x(m)r 1|E(m)) & |1x(m)z-2 ...x(m)o) , 


(8.118) 
(8.119) 
(8.120) 
(8.121) 
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where (8.90) implies 
x(m)L-1 = 1 = Óm.0 


and 
|\1х(т)т—2...х(т)о) = |x(m)) form> 1. 


Hence, we obtain 
He-ini [l (m)) = (1 — 6m,0)|E(m)) ® |x(m)) = (1 — б„о)|Г(т)) 


as claimed. Next, we turn to (8.119) for which we have 


n 
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Нн) = ($197! ә [1 @ 1°" & |0) (0 @ 1°") | (m)) & |х(т)) 


(&10 /=! 
= фр), (È 197! e [1)(1|® 197) |=(m))) 
®|Ох(т)г—2...х(т)о), 
where (8.90) implies 


x(m)r-1 =0 = m=0. 


Therefore, we obtain 


Hinput|T (1)) = »o( у pe e [1)(1| e jen) |0)” e [0)* 
j=l 
=0 


as claimed. To show (8.120), we note that for any m € (0,..., L} we have 


L-2 
Наа (н) = (1% ә У, 1% e J0)(0] e [Du] e 1%) 


5, 


(8.103) f=0 
= |E(m)) ® 
L-2 
У бох ИРСТ \х(т)т—1...х(т)р_01х(т)р—3—1...х(т)о), 
1=0 
where (8.90) implies 


x(m)p-1-1=0 © т<1+1 and x(m).52;—-1 © т>1+2, 


which is impossible and thus Haock| Г (т)) = 0 as claimed. 


E(m)) & |x(m)) 
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To show (8.121), we begin with / — 1, which yields 


HilP(m)) =, ([1*" & (100) (001 + 110) (101) 
(8.105) 
— U1 & |10) (00| — UF & |00) (10]| & 19^?) [£(m)) ә |х) 
qr [E (m)) e (50 + Om,1)|x(m)) 
(8.115) 
= Uj|£ (m)) & ômolx(m + 1)) — Uz |E(m)) & ôm |x(m — 1)) 
=, (3o + sa) (m) 
(8.94) 
= 01 |2(0)) & ёо[х(1)) — Ur|E (1)) & бил|х(0)). 


Here we can use that (8.93) implies U;|2(0)) = |E(1)) and Up |E£(1)) = |E(0)). Con- 
sequently, we obtain 


НГ (т)) = (Sno + бмл)|Г(т)) — à&o|E (1)) & |x(1)) – à1|E (0)) & |х(0)) 


=, (фо + бъ) (т) — mol (1) — nt PO) 
(8.94) 


= (92.0 т $1) (m)) = ôn o| (т + 1)) == Ôn |I (m T 1)) , 


which is (8.121) for l = 1. For 1 < / < L consider 


Hill (m) =, ‚= & (1100) (100| + |110)(110]) 
(8.105 


<“ 


— U; & 19? & |110) (100] 

-Uj @ 1°"? ® [100)(110]] @ 1") |£(m)) © |х(т)) 
Кур |= (m)) ® (1-1 + $1) х(т)) 
— Uj|E (m)) & бы-1|х(т + 1)) — Ur |E (m)) & б|х(т — 1)) 
(9,1-1 + $„1)1Г(т)) 
-UIE — 1)) ® 100) – Ur |E (D) & Sma) 1). 


Here we use that (8.93) implies Uj|£(! — 1)) = |E(/)) and US 5(1)) = |Ж(1— 1)) to 
obtain 
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НГ (m)) = С "p m1) E (m)) 
57 O51 1| E (1) e х(1)) = Ont |Z (I = 1)) ® |х(1 g 1)) 
Ôm,1—1 ЕЗ m) | (m)) = ôn 1 lT (1) a ôm |T (I Е 1)) 


c 
(8.94) 


= (8,1-1 En 85,4) |r (m)) = Om i—1|D (m s 1) = s, i| E (т y 1) . 


Finally, consider the case / = L for which we find 


HITO) =, (ents (110) (10) + |11) (11]) 
(8.107) 
-Uz Q 124-2 e |11)(10| — UF @ 1222 @ |10)(11]) [E(m)) & |x(m)) 
JL Elm) ® (6-1 + sa) lx Qm)) 
(8.117) 
— Ur|E (m)) & бил.—1|х(т + 1)) — Ur |E (m)) & ôn zlx(m — 1)) 


2 (Os L1 T Om,L)|T (m)) 
(8.94) 


- UrJE(L — 1)) & 11х00) — UZ|E(L)) ә ёх — 1)). 


Here we use once more that (8.93) implies Ur|E(L — 1)) = |E(L)) and Uf |E(L)) = |E (L — 
1)). Therefore, 


Hr |I (m)) = (ôm L-1 Ex nL) E (m)) 
= бил—1|Ж(1,)) ® |x(L)) = Ôn LE (L ш 1)) ® |х(1, ш 1)) 


2 (On 1 T m. LII (m)) = блл.—1|Г(1.)) = ôn LI (L — 1)) 
(8.94) 


= (õn L-1 “ү? 6s.) E (m)) — ôn L 1| E (m + 1)) = ôn L| (m = 1)) š 


which is (8.121) for / = L. 


From the results in Lemma 8.21 we see that all the constituents He-ini; Hinput; Наоск 
and Нргор of Hini and Hg; leave the subspace Span {|r (m) | m € {0,... LH invari- 
ant. Consequently, this also holds for Hini and Hg; and, in particular, for Hr (s) for 
all s € [0, 1]. 
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Theorem 8.22 Let Hini and Hg, be defined as in Definition 8.19. Moreover, 
let 


Hr(s) := (1 —s)Hini + SH (8.122) 
for s € [0,1] and 
Нуль :— Span {|r (m)) | m € {0,... Ір : (8.123) 
Then we have 
Ну (5) (Hsu) C Hyup (8.124) 


and {|Г(т)) | m € {0,...,L}} is an ONB of Hsu». In this basis the restric- 
tion of Hr (s) to Hsu has the matrix 


20 0 0 
ОЕ у. 
Е к к А (8.125) 
0 йф M 
0 Dg =зй=8 


Proof Let 
L 
|9) = У Yair (m) 


т=0 


be an arbitrary vector of Hsu». From (8.118)-(8.121) it follows that then 
{Heini V) , Hip] V) , Hato |) , НДӘ) } C Нм. 
With Definition 8.19 we thus have Hprop| F) € Hub as well as 
iHa P), На } C Hsub , 


which implies Hr(s)|'P) € Hsu for Hr(s) as defined in (8.122), and the claim 
(8.124) follows. 

To show (8.125), first recall that from (8.97) we know that the {|I (m)) | m € 
{0,..., Lj) are orthonormal, hence, by definition (8.123) of Hsu» they form an ONB 
of this subspace. From (8.118)-(8.120) in Lemma 8.21 it follows that Hj; as defined 
in Definition 8.19 has the following matrix in the ONB (|I (m)) | m{0,...,L}} 
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Hini Hub = Неї Hun zB Hinput Hub + Наоск Hub 
(8.99) 
00 0 
01 0... 0 
00 10. 
=, Hemig = TE (8.126) 
8.119),(8.120 І А 
(8.119), ) (8.118) .0 10 
0 0 1 
Similarly, it follows that 
Hán Нуль Кур, Нргор] н, s Hinput Hum T Небе Нуль 
(8.100) 
= Hprop| | (8.127) 
(8.119),(8.120) 
Moreover, (8.121) implies that Hprop as given in (8.104) satisfies 
L 
НГ (m)) Nat у Н|Г(т)) 
(8.104) =! 
1 L 
=) У (sai + Sn) (m) 
(8121) =! 
1 L 
т 2 у (был—1|Г(т + 1)) T 5 |I (m 1)) 
1-1 
1(|r(0)) — |Г(1))) ifm=0 
= ‹|Г(т))—»5(Г(т—1))+|Г(т+1))) if1<m<L-1 
1 (г) - Ire- 1))) ifm=L. 
The matrix of the restriction of Hprop to Hsub is thus given by 
| jo 0 
1 1 
-=z 1-5 0. 0 
0-11-50... 0 
Нрхор нь = ал ТЫ К. . (8.128) 
1 1 
0 0-5 1-5 0 
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Consequently, we have 


Hr(s) Нуль LA (1 Е 5) AM s Нь, 
(8.122) 
ES (1— s)Hcini ы, + sHprop Hub ? 


(8.126),(8.127) 


and (8.125) follows from (8.126) and (8.128). 


Exercise 8.106 Let Ну (s) and Hy be defined as in Theorem 8.22, and let 


L 
Psw = У, |Г(т))(Г(т)| (8.129) 
m=0 
be the projector onto this subspace. Show that then 
[Hr (s), Psub] = 0 (8.130) 
holds. 


For a solution see Solution 8.106. 


The result stated in Exercise 8.106 allows us to use Lemma 8.7, which implies that 
since we start with an initial state |Г(0)) € Hgyp, the time evolution Ur(s) gen- 
erated by Hr(s) does not leave the subspace Hub. Hence, we can restrict all our 
considerations to that subspace. 


Exercise 8.107 Let Hsu» be as defined in (8.123) and P,up as given in (8.129). Show 
that for Hprop as defined in Definition 8.19 its restriction? 


Норы, , = Руль HpropPsub (8.131) 


is positive, that is, 
(8.132) 


Hprop Hsub 2 0 


For a solution see Solution 8.107. 


?On the right side Psy on the right of Hprop is viewed as a map Psub : Hsub — HY & НС and on 


the left of Hprop as a map Psub : HY & НС — Нуль such that we can view Н рор [н „asan operator 
sul 


on lHlsup. 
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Recall from Lemma 8.20 that the lowest eigenvalue of Hini is zero, non-degenerate 
and has the eigenvector |Г(0)) = |0)" & |0)”. In the next theorem we show that 
|I) as given in Definition 8.18 is the ground state of Нал, in other words, that 
it is an eigenvector of Hg, for its lowest eigenvalue, which is also zero and non- 
degenerate [34]. 


Theorem 8.23 Let Hub be as defined in (8.123) and Psw as given in (8.129). 
Furthermore, let Hini and Hg, be as defined in Definition 8.19 and Hr(s) as 
in Theorem 8.22. Then for all s € [0, 1] the restriction 


Hr(s) 


Hou» = PsubHr (s)Psub (8.133) 


is positive, that is, 
Hr(s) 


ike 2 0. (8.134) 


Moreover, 


Г) as defined in Definition 8.18, satisfies 
BE) = 0, (8.135) 


and the lowest eigenvalue of Hg; is zero and non-degenerate. 


| Нуль 


Proof From Lemma 8.20 we know already that Heini, Hinputs Наоск апа Нь are pos- 
itive on HY @ НС. Hence, they must be positive on Huy C HY Ф НС as well. More- 
over, Lemma 8.21 shows that Hinpur and Наоск both vanish on Н;ць. Hence, 


Hr(s) Нуль ae (1 Е 5) Hini lag. + Нь |y. 
(8.122) 
(1 = s)Hcini [s T SHprop Hut E Hinput Hub + Hetock Hub 


(1 = s)He-ini bag т SHprop 


sub Нуль 


where we also used s € [0, 1] in the last inequality. This proves (8.134). 
To show (8.135), we note that due to (8.119) and (8.120) we have 


Нпри|Г) =0= Hack |I) . 
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It follows that 


Нал |Г) = НГ) "E НГ) F Hetock Г) = Нргор|Г) 
(8.100) 
and it remains to show that 


Hprop| D) = 0. 


To this end, consider 


г L 
ргор|Г) чк ГЇ у у НГ (m)) 


(8.95),(8.104) 1=1 т=0 
1 L L 
е 2/Т.+1 yd (81-1 ЕЕ 1)1Г(т)) 
= m 1-1 |I (m + 1)) = Ôm | E (m = 1))) 
1 L 
т Ў, (n - 0) e Ir) - ir - ira - 9) 


which completes the proof of (8.135). 


Finally, we show that the eigenvalue zero is non-degenerate. For this let 


m (8.136) 
m=0 
be such that [Ф || = 1 and 


Hein |. I?) = 0. 


(8.137) 
From (8.125) we see that in the ONB {|I (m )) | m € {0,...,L}} the operator 
Наа |н, has the matrix 
ju 
2:73 0, 0... 0 
1—10... 0 
0-5 1-50 : 
Ны m Hr |. 7. 17. (8.138) 
(8.122) (ies |) Loc %ъ 7€ 7 С 
0 0-3 1-4 
0 0 1 1 
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such that (8.137) implies 


1 
Dy, = 5(Фп-1 * Pn+1) =0 


1 
d, – 5 (Q2 +Ф)=0 


1 
~(@, — 0j.) = 0, 
2 
which yields 
® = Dı = $ = -= Pn = Pmi = c]. 


Consequently, (8.136) becomes 


L 
Ф) = Ф Y, |Г(т)) = PvE TIT). 


(8.95) 


proving the non-degeneracy of the eigenvalue zero. 
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Recall that our overall purpose in this section is to show that the action of a given 
circuit U = О... composed of L gates U; can be efficiently replicated (with a 
given probability) by a suitable adiabatic computation. So far we have identified 
the initial and final Hamiltonians Hini and Hj, as well as Ну (s) for this equivalent 
adiabatic computation and have established some of their properties. In particular, 
we have identified |Г(0)) as the unique (up to a phase) ground state of Hini and |I) 


as the unique (again, up to a phase) ground state of Hfn | Huub 


. The following lemma 


illuminates how finding the system in the state |I) is of help in replicating the action 


of a given circuit U = U,--- U1. 


Lemma 8.24 Observing (see Definition 5.35) the state |Г) projects the cir- 
cuit sub-system into the circuit end state U|0)" € HU with a probability of 
1 


L+1° 
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Proof Note that by Definition 8.18 we have 


1 L 
Г) =, орт DO) 
(8.121) т=0 
У ан) & (m) 
= = =(m)) & |x(m 
me Eq 1I: 
1 
= IU - UoJ0)" & |x(m)) (8.139) 
mot L+ m=0 
= 09" & |х(0)) + U1|0)" & |x(1)) +++» + Uz -- 0010)" & |х(1))) 
1 
= (10)" ® |0) + 0110)" & |10...0)* + --- + U|O" ә |1...1)P), 
ы МТ, + 1 


and we see that the circuit end state U|0)" appears in the tensor product with 
Ix(L)) = |1... 1)* as one of the L + 1 terms comprising |I). Since Definition 8.17 
implies that x(m)o = 0 for all m € (0,..., L — 1}, we find that observing the final 
state |"), namely, measuring the observable (see Definition 5.35) 


XP = 18” & 197-1 ® б; 


in the state |I), will yield the eigenvalue +1 with probability P (because 0;|0) = 
[0)) and the eigenvalue —1 with probability LH (because o;|1) = —|1)). If we have 
measured the eigenvalue — 1, then, according to the Projection Postulate 3, the sys- 
tem will be in the corresponding eigenstate obtained from projecting |I) onto the 


eigenstate. The projector onto the eigenspace Eig( XU "€, — 1) is given as 


Р_1:= 18" 891%! ә |1)(1|, 
and its application to |I) yields 


Р_1|Г) =  U|o e 1...) - eH" emt. 
(8.139) 


This is a separable state with density operator 


Bor (uro e [1...1))(#(0|0* ® (1...1) 
(233) 
= Ulo oju* e [1...1)(1...1| (8.140) 


(3.36 


— 
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in the composite circuit and clock system IH" @ НС. The sub-system in the circuit 
space is described by the reduced density operator p" (p) for which we obtain 


U =, ae cx d ni rr 
p” (р). =, u^ (p), = tre (UJOICOJU* &|1...1)(1...1]) 
(3.50) (8.140) 
= tr(|1... D) (1...1]) uJo)'(o|U* = uo) (oju* 
5 t(l ) |) U]0)(0| |0) 0| 
(3.57) EE 
LL Puloy › 
(2.89) 


that is, the system described by HY is then in the pure state U |0)", which is the end 
state of the circuit computation. 


The state |I (0)) will be the initial state of the adiabatic computation. The system 
will then be subject to the time evolution generated by Hr (s). Provided Hr (5) satis- 
fies the Adiabatic Assumption (AA), Theorem G.15 with Corollary 8.3 and Corol- 
lary 8.4 yield bounds on the probability to find the system in the ground state |I) at 
the end of the adiabatic time evolution generated by H7 (s). More precisely, Corol- 
lary 8.4 tells us how large we have to make the transition period T = tfn — fini (or 
‘how long we have to wait’) for a given spectral gap g(s) in order to achieve a 
desired lower bound pmin on the probability to find |I). 

Such a replication of the circuit action by means of an adiabatic computation is 
said to be efficient if the transition period Т increases at most polynomially with the 
number of gates L. In order to verify that our construction of H7(s) is sufficient to 
ensure this efficiency, we thus need to 


e ascertain that the Adiabatic Assumption (AA) required for the applicability of the 
adiabatic Theorem G.15 and its corollaries 8.3 and 8.4 is satisfied; 

e determine a lower bound for the spectral gap go(s) of the ground state of Hr (5). 

Both items require а more detailed spectral analysis of Ну (s) [к E We begin this by 


exhibiting the set of equations which the coordinates (in the ONB ur (m)) | тє 
{0,...,L}}) of the eigenvectors of Ну (s) Lae „ have to satisfy. 


Lemma 8.25 Let s € [0, 1] and 


E 
|Ф(в)) = Y, Ф(5)һ|Г(т)) € Hsu . (8.141) 


m=0 


Then |®(s)) is an eigenvector of Hr (s) n , with eigenvalue E (s) if and only 
if the B(s)m satisfy for m € {0,...,L} 
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Ф(в)у = a(s)®(s)o (8.142) 
Ф(5),„ = b(s)D(s)u-1— O(s)n-2 form € Q,...,L — 1} (8.143) 
Ф(5) = c(s)O(s)r.i, (8.144) 
where 
a(s) = a(s, E(s)) = 1— E 
о —— (8.145) 
с() = «(s E()) = — TO = 


Proof Using the matrix of Ну (s)| , in the ONB  Г(т)) | m € {0,...,L}} as 
given in (8.125), together with (8.141) and the eigenvalue equation 


Hr (5) | „1Ф(8)) = E(s)|®(s)) , 
gives 
2—20 0... 0 Ф(5) (s) 
-31-750.. 0 Ps Bey 
0 -š 1—5 0 Ts M Ф)› 
0... 0 -š 1 4 o(s), 1 P(s)1-1 
0... 0 ЕЕ Ф(5)1. Ф (5). 


Evaluating and re-arranging the component equations yields (8.142)-(8.144) with 


(8.145), showing that these equations are equivalent to the eigenvalue equation for 
| (s)) in the ONB {|Г(т)) | m € {0,...,L}}. 


From Theorem 8.23 we know that Hz (s) Я > 0, and it follows that we must 
have E(s) > 0 for any of its eigenvalues as well. We continue our investigation of 
the spectrum of Hz (s) li: Я in a number of exercises until we have enough material 
to convince ourselves that it satisfies the Adiabatic Assumption (AA). 

As we shall see below, we may assume that 0 € E(s) < 1 + s since we will find 
that all eigenvalues of Hr(s)la. satisfy this property. For further consideration 
we sub-divide the range [0, 1 + s| for the eigenvalues into two domains. The first 
domain will contain the lowest eigenvalue Eo(s). The second domain will contain 


a further L eigenvalues E,,(s) for m € (1,..., L), which will be shown to be non- 
crossing. 
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Domain 1: is given by E € Dı = Di(s) := [0,1 — s], which implies 


I-E _ b(s, Е) d 
s “м 2 > 
(8.145) 


Domain 2: is given by E € Dz = D2(s) :=]1 — s, 1 + s|, which implies 


1-Е _ b(s,E) 
е 


1< <1. 


“MY 
(8.145) 


For these domains D;, where j € {1,2} we define 


Со (и) :=coshu, 81 (и) :— sinh u 


Соз (и) := cosu, Siz(u) := sinu 


(8.146) 
af1-E arccosh (+£) for E € Di 
Ө;(5,Е) := Co { —— | = 1-5 
5 arccos ( = ) for E € Р» 
such that for both domains we have 
b(s,E) = 2 Со; (0;(s, E)) ‘ (8.147) 
Exercise 8.108 Forj є {1,2} and m € (2,...,L — 2} let 
(s)m = Aj Со; (т0;(5, E(s))) + B; Si; (m6;(s, E(s))) . (8.148) 


where А;, В; € C and Соу, Si; and Ө; are as defined in (8.146). Show that the (s), 
are a solution of the recursion (8.143). 


For a solution see Solution 8.108. 


The solutions (8.148) of the recursive equations (8.143) for the components of the 
eigenvectors still contain two free parameters A; and Bj, which we will determine 
with the help of the boundary conditions (8.142) and (8.144). These two bound- 
ary conditions will yield equations for Ө; (s. E). Eigenvalues of Ну (5) li are then 
found as implicit solutions E = E(s) of these determining equations. Hence, the 
next step is to establish the equations for 6; (5, Е) from the boundary conditions. 
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Exercise 8.109 Using the definitions (8.146) we define furthermore for j € (1,2) 


_ Siu) _ | ifj=1 Bid 


tan u ifj=2. 


Let s €]0, 1] and j € {1,2}. Using the boundary conditions (8.142) and (8.144), 
show that any eigenvalue E(s) € Dj of Hz (s) liz , has to satisfy 


(c -a)y (- 1) (4 — Р?) 


b(a+c)—2ac—2 ' SR) 


Taj ((L — 1)6;(s, E(s))) = 


where a — a(s), b — b(s) and c — c(s) are defined as in (8.145). 


For a solution see Solution 8.109. 


Either side of (8.150) can have singularities, but we will ignore this for now and 
consider them later in the proof of Theorem 8.26, where we use this equation to 
prove that the eigenvalues of H7(s) нь е non-crossing for 0 < s < 1. 

Note that the right side of (8.150) does not depend on L. It can be written in a form 
which makes the s and E dependence more explicit and makes it more amenable to 
further analysis. 


Exercise 8.110 Define 


(8.151) 


(1 + М1 —25+ 25?) 
1 
2 


= (1+s+ 1+8) 


(s = ‚ (E — z4)(E —z_) зу —Е 
hj(s, E) := (—1)/ (E —ру)(Е—р_)\/ lve = s)’ 


where hj; is only defined in the respective domain D; with j € {1,2}. Show that for 


each domain D; 
(cca) VCG- _,„ 
b(a +c) - 2ас - 2 = hj(s, E(s)) . (8.152) 


For a solution see Solution 8.110. 
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Combining (8.150) with (8.152) shows that any eigenvalue of Hr(s)| 
a solution E = E(s) of 


has to be 
Hub 


Ta; ((L — 1)0;(s, E)) = h;(s, E) . (8.153) 


In the proof of Theorem 8.26 we will show that in Dı U D» there are exactly L + 1 
such solutions. Since dim HI | = L + 1, this implies that every solution of (8.153) 
in Dı U D» gives an eigenvalue of Hz (s) lis E In order to facilitate the analysis in 


the aforementioned proof, we first provide some properties of the si,z4 and p+ 
defined in (8.151). 


Exercise 8.111 Show that the functions 5+ (5), 2+ (5) and p(s) satisfy 


z-(0) = p-(0) 20 < 1 =z,(0) =р+(0) = s«(0) 

z-(s) < p-(s) < s-(s) < z«(s) < p+ (s) < s4 (8) fr0<s< 3 (8.154) 
z-(s) < s_(s) € p- (s) < z«(s) < p+ (s) < s4 (5) frå <s<1 ` 
z-(1) 2 (1) 20 < p-(1) < z1) < p4(1) < s; (1) 


For a solution see Solution 8.111. 


Theorem 8.26 Let Ну () and Hyp be defined as in Theorem 8.22. Then 
Нт (s)| А satisfies the Adiabatic Assumption (AA). In particular, we have 
for 0 « s € 1 that 


Eo(s) € s-(s) < Ei(s) € --- < Ex(s) < (5). (8.155) 


Proof With Hr(s) defined as in (8.122) it is obvious that it is twice continuously 
differentiable, in other words, that item (i) of the Adiabatic Assumption (AA) is 
satisfied. 

That item (ii) is satisfied follows from the fact that dim Hup = L + 1 and that— 
as we shall show below—Hr(s) | А has L + 1 distinct eigenvalues for 0 < s < 1. 
Consequently, each of the eigenspaces remains one-dimensional for s > 0. 

As mentioned above, (8.150) with (8.152) shows that any eigenvalue E — E(s) 
of Hr(s) liis has to be a solution of 


Ta; ((L — 1)0;(5,Е)) = hj(s, E). (8.156) 


We analyze both sides of this equation in the two domains. As for the right side 
of (8.156) in the domain Р}, in which 0 < E < s. , we note from its definition in 
(8.151) and (8.154) that in D, the function E +> / (5, E) has a zero at z_ and poles 
at p- and s_, where p- < s- fors Є]0, 3[ and s- < p- for s € [3,1]. 
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In the domain D» for which s- < E < s}, we see again from its definition in 
(8.151) that in this domain the function E к> ho(s,E) has a zero at тү and poles 
at p_ and р}, where we know from (8.154) that for s €]0, 2 | the only pole in the 
domain is p... and for s € [2. 1] both p+ are in Do. 

Moreover, we find after some lengthy calculations 


д " 53 (2E(s — 2) — 2s? +s + 1) (—1)/(Е — s.) 
ag" E = тео (аз) ү s-E C 


such that for s €]0, 1] and E € Di U D2 ~ {p+, s+} we have 


x ^ uA 1+5 – 25 
Е E = Е(5) : .157 
3g Elg-9 < ():7 ^36 55 (8.157) 
and 2 
agi E) 20 e Е<Ё(5). (8.158) 
Exercise 8.112 Show that for s €]0, 1] 
3 А 
5 < 4 e p.«Ecxs. 
5 : p- E=s (8.159) 
3 
s> 1 => p_>E>s 


For a solution see Solution 8.112. 


The location of zeros and poles together with the results (8.157)-(8.159) show that 
the functions Л; in their respective domains have graphs as shown in Fig. 8.3 for 
5 < i and in Fig. 8.4 for s > 3. 

Let us now turn to the left side of (8.156) in the two domains. First consider 
this equation in D; in which 0 € E < s... For any given s Є]0, 1] we take the non- 
negative solution for Ө (s, E) in (8.146). Then it follows that 0; (s, E) as a function 
of E is positive and decreasing for0 < E < s = 1 — s until it becomes zero at s_. 
This also holds for (2, — 1)0; (s, E) as well as Ta; ((L — 1)0i(s, E)). 
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h,(0.5, E) 


0 4 
| 4 Z4 


p- s- рь S 


Fig. 8.3 Graph of functions E — h;(4,E ) for both domains D; and D». The thin vertical lines 
show the location of the poles. This shape is generic for s Є]0, 2l and does not depend on L 


h,(0.9, E) 


8 
6 
4 
2 
E 
Z- 2 


+ 


s- p- p+ S4 
E 


Fig. 8.4 Graph of functions E +> Aj( 4 ‚ E) for both domains D, and D». The thin vertical lines 
show the location of the poles. This shape is generic for s €] 3, 1] and does not depend on L 


In the domain D» the function E > Ta» ((L — 1)6»(s, Е)) has singularities at the 
points Es, where 


Е 294-1 
ӨЕ = a, :— xL p^ forge (01,72) (8.160) 
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since these are the points where Co» ((L — 1) @2(s, ЕЁ; )) = cos ((L — 1) @2(s, Es,4)) 
= 0. It follows from (8.146) that 


Es q = 1 — s cos Gy. (8.161) 


We use these points to divide the domain D» for E into the L intervals 


I; = Һ(5) :—]s- (5), Eso] 


h = h(s) :=]Es0, Es] 


: (8.162) 
Ir- = еа) :=]Es L-3, Es 1-2] 


Ij = (s) :=]Es 1-2, s+ (s)|. 


The functions Ta; in their respective domains have the graphs of the shapes as shown 
for L = 7 in Fig. 8.5 for s < 3 and in Fig. 8.6 for s > 3. 

For a given s €]0, 1] the solutions E = E(s) of (8.156) can be characterized as 
follows: 

in Di(s) = [0, s (5)] there is exactly one value 0 € Eo(s) < 1 — s; 

in Do(s) =]s- (s), s+ (s) [ consider first those s where the poles of E ++ Ta» ((L — 
1)6»(s, E)) and E > h»(s, E) do not coincide, that is, where p4 (s) A E; for all 
(5,4). 


Taj((L — 1)6;(0.5, E)) 


Eso Es1 Es2 Ез Esa Ess 


Fig. 8.5 Graph of functions E > Ta; ((L — 1)0(1,Е )) for both domains D, and D» and = 7. 
The thin vertical lines show the location of the poles Esq. This shape is generic for s Є]0, il 
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І s 
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So 
E 
H 
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4 pL 5 — - -— PEN 
Eso Es1 Es2 Es3 Esa Es 5 


Fig. 8.6 Graph of functions E — Та; ((L — 1)6(35 , E)) for both domains D, and D» and L = 7. 
The thin vertical lines show the location of the poles E; q. This shape is generic for s €] 3, 1] 


Exercise 8.113 Suppose s €]0, 1] is such that p+ (5) Z Es, forallg € {1,2,...,L}. 
Show that then рі (s) Є А (s) for some q+ € (1,2,..., L} implies 


L 
q- «571 
L (8.163) 
у ИРЕ 


For a solution see Solution 8.113. 


Note that (8.163) implies that while p_(s) can fall into /;(s), none of the poles 
p(s) can be in Ir(s). As the following Exercise 8.114 shows, another consequence 
of (8.163) is that both poles cannot be in the same interval. 


S 


Exercise 8.114 Show that for L > 1 we cannot have рі (s) € Ij. 


For a solution see Solution 8.114. 


The locations of the solutions of (8.156) in the intervals of Do(s) = Л (5) A --- A 
Ir (s) are then as follows: 
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e From (8.163) we see that neither p(s) nor p. (s) can be in the right-most 

interval / (з). Since we have h(s, E) > for E Є|р+ (5), s. (s)| and Та ((L— 

1)6;(s, E)) < 0 for E €JE, 1 2. s. (s)[, it follows that there is no solution of 

(8.156) in Ir (s). 

In the interval 74, (s) which contains рі (5), there are two solutions of (8.156), 

one at either side of p4 (s). This is because h2(s, E) tends to —œ as E 7 p, (s) 

and Mm (s, E) — +% as E N p, (s), and Таз ((L — 1)62(s, Е)) is increasing from 

—œ at E N Е. 2 < p(s) to +œ at E Z Esa, 1 > po (s). 

Similarly, in any interval /, (s), which contains p. (s) and for which q- 5 1, 

there are two solutions of (8.156) separated by p. (5). 

If p (s) € I (s), there is only one solution E €]p (s), Es o| of (8.156) since 

h(s, E) > +% as E N p- (s) and Ta? ((L — 1)6»(s, E)) + +% as E / Eso > 

p-(s). For E €]|s (s), p-(s)] there is no solution since there /(s, E) < 0 and 

Та ((L — 1)0(5,Е)) > 0. 

In every other interval /,(s) for q € (2,...,L — 1} \ {q+} that does not contain 

pa. (s) and is neither J; nor Ij, we find exactly one solution of (8.156) since there 
h(s, E) is finite and decreasing and Ta» ((L — 1)0(5, E)) covers all of R as E 
ranges between E; д2 and E; 1. 

e If p (5) 52 h(s), there is no solution in I, (s) since A»(s, E) < 0 for E € s. (s), 
р- (s)[ and Ta; ((L — 1)6(s, E)) > 0 for E €]s. (s), Eso[. 


In summary we have in D», in the case where рі (s) # Esq for q € (1,...,L — 2}, 


e one solution in each /,(s), q € (1,...,L — 1) У {q+} plus two solutions in 74, (5) 
if p_(s) € li(s) 
e one solution in each /,(s), q € (2,...,L — 1) « {q+} plus two solutions in each 


144 (s) if p- (s) € h(s). 
In total we have thus L distinct solutions in D2(s), which do not cross or coincide 
as s varies in ]0, 1], as long as p«(s) A Esq for q € (1,..., L — 2}. Together with 
the one solution in Dj (s) these give the L + 1 eigenvalues of H7(s) lis , Generic 


examples of these solutions are shown for L = 7 in Fig. 8.7 for s < 1 and in Fig. 8.8 


for s < à. 

Consider now the case p(s) = E;,, for some r4 € (1,...,L — 2). We claim 
that then E(s) = Es, = p. (s) is an eigenvalue of Нт(5) Е This can be seen as 
follows. 


Recall that our Ansatz (8.148) for the components of the eigenvectors satis- 
fied the recursive part (8.143) of the eigenvalue equations. To obtain a solution for 
the eigenvalue equation, one still has to impose the boundary conditions. In Exer- 
cise 8.109 we showed that this resulted in (8.150). In the proof of this, we found in 
(G.182) that whenever E is such that 


(1 + ac — ab)sin((L— 1)0(5,Е)) = (c — a)sin((L—2)0»(s, E)) (8.164) 
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8 


64 


h,(0.5, E) and Taj((L — 1)6;(0.5, E)) 


Fig. 8.7 Determination of the eigenvalues of Hr (5) for the case L = 7 as intersection of 
Taj ((L — 1)6j (4. E)) (gray lines) and hj (4, E) (black lines). Here Ta; (2,5) and h (2,5) аге 
shown for E € рү (2), whereas Ta; (5,£) and hy (5,£) are shown for E € Р» (5) 
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hj(0.9, E) and Taj((L — 1)6;(0.9, E)) 


Fig. 8.8 Determination of the eigenvalues of Hr (5) for the case L = 7 as intersection of 


Taj ((L — 1)6j (15, E)) (gray lines) and Л; (i5, E) (black lines). Неге Ta, (i5, E) and hy (2,8) 


аге shown for E € рү (15). whereas Ta» (5,6) and h2 (2,8) аге shown for E € D» (4) 
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then the boundary conditions are satisfied. Consequently, E is an eigenvalue of 


Hr(s)[g, ,.- For E — E,,, we have 


u 2r. 4-1 


MT e 
(8.161) 


O»(s, E) л 


such that (L — 1)6»(s, E) = (2r+ + 1)5 and 


sin ((L — 1)6»(s, Е)) В ~ (8.165) 


E 
cos ((L — 2)0»(s, E)) 


Moreover, using sin(x — y) = sinx cos у — cos x sin y with x = (L — 1)@) and y = 
Ө, we find 


sin ((L — 2)0;(s, E)) = (—1)'* cos 6; (8.166) 


Inserting (8.165) and (8.166) into (8.164) gives 
b 
1 +ас – ab = (с– а), 


which is equivalent to 
b(a+c) -2ac - 2 = 0. 


Using (G.186) (and the fact that E = p(s) also precludes 2 — 2E — s = 0), this in 
turn is equivalent to 
(s- — EE — p+)(E - p-) =0, (8.167) 


and this holds true since we consider the special case E = p, (s) = Еу ту. Hence, 
such an E solves (8.164) and has to be an eigenvalue of Нт (s) lis E 


The very same arguments apply if E = E(s) = p- (s) = E,, since E — p- also 
appears in the left side of (8.167), making such Е also eigenvalues of H7 (s) ee E 


With our definition (8.163) of the intervals J, = I;(s), we see that p. (5) = Es, 
or p_(s) = E,, implies p. (s) € I +2 or p (s) € I, 45 for r4 € (0,1,...,L— 
2). Now, p- cannot be in Iz. Whenever р— € I, +2 for r- € (0,...,L — 3}, we 
have one eigenvalue given by E = E,, = p. inl, +2 and a second eigenvalue in 
I, 42 asa solution of (8.156). This is because for E Є]Е,, ,p.[, where E,; = p_, 
we know that ^2 (s, E) is finite and decreasing, and Ta» ((L — 1)62(s, E)) covers all 
of R as E ranges between Ex and Esr +1. Hence, every interval which contains 
p- also contains two eigenvalues. 

The same applies for p+ € J,, +2 as long as r4 +2 Æ L. If r4 + 2 = L, then Iz = 
[Es r}, S. (s)| contains exactly the one eigenvalue E = Е, „, and as before D» \ Л, 
contains L eigenvalues. 
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Fig. 8.9 Eigenvalues of Hr(s) as a function of s € [0, 1] for the case of L = 7. Note that then 
dim Hsub = L + 1 = 8. The dashed lines show the domain-delimiting lines s+(s) = 1 + s. The 


black circles show the eigenvalues at s = 1, whereas the squares show them at s — 5 


Our analysis of the solutions E — E(s) of (8.156) thus implies the following: for 
each s €]0, 1] we have one eigenvalue Eo(s) € Dj(s) satisfying Eo(s) < s (s) and 
L eigenvalues Ej(s) for j € (1,...,L) in Do(s) satisfying s (s) < Ei(s) < -+ < 
Ej (s) < s, (s). This is once more illustrated in Fig. 8.9, which shows the eigenval- 
ues of Hz (s) I. for the case L = 7 as s varies from О to 1. Also shown there more 


prominently are the eigenvalues for the two sample values s — 5 (as circles) and 
5 = ij (as squares). 

Recall that our goal in this section is to show that any quantum circuit U — 
Urz + О comprised of L gates can be simulated efficiently, namely with T € 
poly (L), by a suitable adiabatic computation. 

So far we have presented a generic method to construct a suitable time dependent 
Hamiltonian Ну (5). This Hamiltonian is suitable because at the initial time fini it has 
the known ground state |I (0)), and at the final time fin it has the ground state |I), 
which contains the circuit action end state U |0)" in one of its components. We have 
also shown that by measuring a certain observable in the state |I), we will obtain 
О |0)" with a probability of тїт. Moreover, starting from |Г(0)) the time evolution 
generated by Ну (s) leaves a finite-dimensional subspace Н. ць invariant. On this sub- 
space the Hamiltonian Ну (s) I. satisfies the Adiabatic Assumption (AA) required 


for the application of the Quantum Adiabatic Theorem G.15, Corollaries 8.3 and 
8.4. These tell us that the time-evolved state is suitably close to the desired final 
ground state |Г), provided ae is sufficiently small. Ultimately, we want to derive 
an estimate as to how T grows as a function of L if we are to guarantee a given mini- 
mal probability to find |"). Hence, we need to obtain a suitable bound on the growth 
of Co(1) as a function of L. Lemma 8.27 provides a first step in that direction. 
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Lemma 8.27 Let Hr(s) be as defined in (8.22). Then Co(1) as defined in 
Theorem G.15 satisfies 


3 3 1 du 
Co(1) € dE | зо | i 8.168 
o( ) = 2 0 go(u)? ( ) 


Proof Applying the results of Corollary 8.6 to Ну (s) as defined in (8.22) and keep- 
ing in mind that we only need to consider the restrictions on Hsup yields 


І 1 
c) <, (|н, |19, ||) төр (8.169) 
(2.53),(8.19) 
1 du 
+ 10 (Інь, ЕЕ || Hui Hub Ini x . 


From (8.126) we see that the largest eigenvalue of Н lit " is 1 and it follows from 
(2.50) that 


| [Hini 


Hall = 1. (8.170) 
Likewise, (8.155) shows that the eigenvalues of Нт (s) là , аге bounded from above 
by + (з) = 1 + s. Considering that Hg 
with the help of (2.50), that 


|в, = Hr( 1g we thus obtain, again 


<2. (8.171) 


|| Hos 


Нуль 


Inserting (8.170) and (8.171) into (8.169) yields the claim (8.168). 


The one ingredient still missing to obtain a bound on Co(1) is the behavior of 
the gap function go(s) = Ei(s) — Eo(s) as the number of gates L increases. Before 
we can exhibit this in more detail, we need a few more auxiliary results. The first 
of these is given in the following theorem, which contains the so-called max-min 
principle. 


Theorem 8.28 Let Н be a HILBERT space with dim H = d < œ and let A € 
BAH) with a set of eigenvalues o(A) = (Aj | j € {1,...,d}} such that 
AA AE (8.172) 


Then we have for every w € {1,...,d} 
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E н = Н,, subspace оў Н with \ 

А = max { min { (PAP) | [V) € Hw, [II] = 1} | И 
(8.173) 


Proof Let {|®)) | j € {1,...,d}} be an ONB of H consisting of eigenvectors of A 
and define 


Ty := max { min { (WAP) | |У) € Hy, 21 — 1} | Ну subspace of H vu 


dimH, =d—w+1 
(8.174) 
In a first step we show that Tẹ > Aw. For this we choose Hl, as the subspace 


Hwy = Span{|®,,),...,|®z)}. 


Then we have dim Н» = d — w + 1 and A, is the smallest eigenvalue of Ali, - The 


result (2.40) of Exercise 2.9 then implies that for any |У) € Hy with ||¥|| = 1 we 
must have (V|AW) > А,,. For ty as defined in (8.174) it thus follows that 


Ty > А. (8.175) 
We now proceed to show the reverse inequality. For this let Н,, now be an arbitrary 


subspace of H with dim Н, = d — w + 1, and let { | Ок) | ke {l,...,d w+ 1}} 
be an ONB of this subspace. For any |V^) € Н,, we thus have 


d—w+l 
У #10), (8.176) 
k=1 
where 
d 
lk) = У Мь|Ф,)), (8.177) 


since {|®,) | j € {1,...,d}} is an ONB of H. Consequently, we obtain for any 
le {1,...,d} that 


d—w-4l d—w-4l d 
(D|P) =, TN (ФО) =, Y Фу, My (ФФ) 
К=1 К=1 j=l ba od 
(8.17 pee 177) —ójl 
d—w4l 
= У "My. (8.178) 


К=1 
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This allows us to find |) € Hi, such that 


|P) € (Span{|®y+1),...,|®z)})~ = Span{|1),...,|Py)} (8.179) 
as follows. The requirement (8.179) is equivalent to 
(ФР) 20 forle{w+l,...,d}. 
From (8.178) we see that this means that |'P) has to be such that 
d—w+l 
У %Ми=0 forle {w+1,...,d}. 
k=1 


This is a set of d — w linear equations for dim H,, = d — w + 1 unknowns %. It can 
always be solved and the remaining one unknown can be used to normalize |) to 
1. This means that in any subspace IH, С Н of dimension d — w + 1 we сап always 
find a |) € Span{|®;),...,|®,,)} with ||| = 1. Now, the operator A restricted 
to Span{|®;),...,|®,) has the eigenvalues A1, . . . , A. Because of the assumption 
(8.172), the largest of those is A,,. The result (2.40) of Exercise 2.9 then implies that 
for any |F) € Span{|®,),..., |®,,)} with ||| = 1 we must have 


(PIAP) < Ay. 


Since we have shown above that for any H,, C Н with dim Н» = d — w + 1 we can 
always find a |У) € H,, N Span{|®,),...,|®,)} with ||Ч|| = 1, it follows that 


min { (PAP) | |P) € Hw, ||P] = 1] < Aw. 
Therefore, due to its definition in (8.174), т, also satisfies 
Tw < Aw , 


which, together with (8.175), implies т, =A, and completes the proof 
of (8.173). 


For the proof of our desired result about the growth of go(s) as a function of L 
we need one more auxiliary result, which is given in the following lemma. 
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Lemma 8.29 ([116]) Let |Г(0)) be as defined in (8.94), Hg, as in (8.100) 
and Hsw as in (8.123). Then the lowest eigenvalue Eo of 


Him (нь + гого), (8.180) 
sub 
satisfies for L 7 8 

1 T 

B «Eo < 1. (8.181) 


Proof From (8.138) we see that Н in the ONB { |Г(т)) | m € {0,...,L}} has the 
matrix 


1-10 0 0 
-i1-i0 0 
1 1 
0 0-11-i 
0 00-11 


Consequently, the eigenvalue equation Н|Ф) = Ё|Ф) implies for the components 
Ф, of the eigenvector 


L 
Ф = $ duros) 


in the basis {[Г(т)) | m € {0,...,L}} that 


Ф, = 2(1 — E) by (8.182) 
®,, = 2(1- Ё)ф, 1 – Ф, ; form € {2,...,L—1} (8.183) 
; D ou 
ф фу. 8.184 
i oe Aa ( ) 
Assuming that 
Ё = 1 — cos 0 (8.185) 


for a 0 €]0, z|, we make the ansatz 


®,, = sin ((m + 1)0) (8.186) 
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for m € (—1,..., L}. Using 
2cos о sin В = sin(a + B) — sin(a — В), (8.187) 


we then find with œ = 0 and B = m0 that 


Dy, = sin ((m+ 1)0) =  2cos Ө sin(m0) — sin ((m — 1)0) 
(8.186) (8.187) 
=, 20-É4,;-ó,., (8.188) 


(8.185),(8.186) 
for m € {2,...,L}, which shows that (8.183) is satisfied by our ansatz. But (8.188) 
also holds for m — 1, in which case it shows that (8.185) together with (8.186) also 
satisfies (8.182). 
To satisfy (8.184), we require in addition that 
(1 — 2Ё) sin ((L 4- 1)0) = sin(L@). 
Using (8.185), this becomes 
2cos 0 sin ((L+ 1)0) = sin(L@) + sin ((L + 1)0) , 
where we can again make use of (8.187) to obtain 


sin ((L + 2)0) = sin ((L-- 1)0). 


Since sin œ = sin B implies B + a = (2p + 1)z or B — о = 2qr for p,q € No, it 
follows that we must have 


л or 0—2qn їогр,4 є No. 


The second possibility can be discarded because (8.186) implies that in this case 
|Ф) = 0, which is not a permissible eigenvector. 
The first possibility allows for L + 1 distinct eigenvalues of Н given by 


x 2p + 
Ey =1- 
р cos & Е 


1 
57) for p € {0,...,L}, 


and since (8.123) implies dim Hsub = L + 1, these are all possible eigenvalues of H. 
The lowest eigenvalue is 


Y T 
Eo = 1 — cos (5) «1 (8.189) 
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and evidently satisfies the upper bound given in (8.181). In order to obtain the lower 


bound n for Eo, we note first that the series expansion 


e (_1)ky2k 2 
ips d Ја 


k=0 


(2k)! 2 


implies 
2 
1 — cosx = 5 — R4(x). 


For |x| < 4 the remainder 


md d) 


20 20 
ao 
TER Е x6 x49 10 Е x4 x6 " x9 x10 12 
4 = 6! 8! 10! 41 6! 8! 10! 12! 
eS 
<0 <0 
satisfies 
x4 
0< R4(x) < ҮП 
such that 
2 44 
]— > — – —. 
cosx > 3 7M 
Applying this to (8.189) yields 
л? a^ 


Ey > 
°= 201+ 3)2 24(2L + 3)4 


Here we can use that for L > 8 


24(2L + 3)?’ 
which implies 
л? n’ l 
2(2L-3)? 24(2L+3)4 ~ 17 


Together with (8.190), this gives 


and completes the proof of (8.181). 


(8.190) 
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After all these auxiliary results we are now in a position to give a rigorous lower 
bound for the ground state eigenvalue gap go(s) of Hr(s) m v 


Theorem 8.30 ([116]) Let Не (в) |ы be defined as in (8.133) and let 


{E;(s) | j € {0,...,L}} be the set of its eigenvalues. Then the ground state 
energy вар go(s) = E\(s) — Eo(s) satisfies for L > 8 


(8.191) 


Proof We know already from Theorem 8.26 that for s €]0, 1] the eigenvalues E;(s) 
of Hr (5) |. „ Satisfy Eo(s) < Ei(s) < +++ < Еу (s). From the matrix of Hr (s) |y, | 


in the ONB {|Г(т)) | m € {0,...,L}} of Hsub as shown in (8.125) we see that 


5 
(г(0)1н (9), 09) = > 
and that for | Г) as defined in (8.95) 
L(1-— s) 
('IBr(s) нь) Е ЗГЕ 
The result (2.40) of Exercise 2.9 then implies that 
L(1— 
Eo(s) < min B D D } ; (8.192) 
and the two lines s — 5 and s > His) cross at 
2L 
с — y 1 
“e = 3LF] Sn) 


Since we may assume L > 1, we have t > E and thus 2L > AM which implies 


1 
ре 194 
Se > 5 (8.194) 


On the other hand, we have 2L < еы such that 


2 
Sc < 3: (8.195) 
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These two bounds for s; will be used later. For now let us turn to Ej(s). From 
Theorem 8.28 we know that 


Ej(s) =, max (min { (Но (5), P) | |) € Eo, [| = 1} 
(8.173) 


| Н» subset o£ H with dimHa = 1+1—2+1 zu. 


For the subspace Hz = Ѕрап{|Г(1)),..., |l (L)) ) it follows that 


Ej(s) > min ((P|Hr(s) |...) | |I) € $рап{|Г(1)),...,|Г(1))}, IP] = 1}. 


(8.196) 


) lis 


Now, inserting 


Ни), > н, = IOT O) 
(8.126) 
4 1 
Нь. (s), = Ñ- 51700) T) 
(8.180) 
in the right side of 
Hr(s) Has (1— s)Hini(5) |i... + sHgn(s) Has 
(8.122) 


yields 
Hr (s) 


н = 0 Ны +әй + (17 2) IFO) OI. 


Since for any |) € H5 = Ѕрап{ |Г(1)),...,|Г(2)) } we have (Г(0)|Ҹ) = 0, it fol- 
lows that for such |') € Н with ||‘¥|| = 1 


(|Н (s). P) = (1—5) + (PAY). (8.197) 


Denoting the lowest eigenvalue of H by Ep, the result (2.40) of Exercise 2.9 tells us 
that (PAY) > Ep, such that (8.196) becomes 

E\(s) 2 {min{(¥|Hr(s)|q | P) | IY) € $рап{|Г(1)),...,|Г(1))}, [Ф| = 1j 
> 1—5+Ёу, (8.198) 
(8.197) 
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апа we obtain 


E\(s) — Е,(0) > 1—54 


8 Adiabatic Quantum Computing 


—— 
(8.192),(8.198) 


Here we observe that, with se as defined in (8.193), then s Z 5 


L(1—s) 
E+] * 


Hence, we have 


and thus (8.199) becomes 


2 as + sEo 
L(1—s) 


E — E,(0) > Y 
i(s) - E(0) > аи (i 


(8.199) 


=. eee E 
с = zr implies 5 2 


ifO < S< 5, 
ifse<s<1, 


ifO < S < 5, 


| (8.200) 
ifs.<s<l. 


We consider the two cases separately. For the case 0 < s < s; we note that 


ds 2 


d 3s " s 
— | 1 — — + 860 | = Eo — 


3 

= 0 
2 мя 
(8.181) 


such that for s € [0, se] the function 1 — E + sÉo attains its lowest value at the rightmost 
boundary s = з. Consequently, we find in the case 0 < s < se that 


3 Y 3 " Е 
ВИА) > 1- Ë eRe i= a. > si (8.201) 
м 2 2 — 
(8.200) (8.195) 
For the case s €]sc, 1] we observe that 
E\(s)—Ex(s) > 1—s-4sÉ LUN ы sain (8.202) 
105 245S 2 S T SEQ Dau Fg en ИА . 
(8.200) 
Therefore, we finally have 
imum me Eo 
s) = E (s) — Eo(s 5 = ETE 
80 1 0 e бо 2,370. = эр 
(8.201),(8.201) (8.194) (8.181) 


We can now combine the results of Corollary 8.4, Lemmas 8.24, 8.27 and 
Theorem 8.30 to prove a statement about how the time T required to approximate 
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the action of the circuit U = U,---U; with an adiabatic computation scales as a 
function of the number of gates L in the circuit. 


Theorem 8.31 Let the circuit U be as in Definition 8.18. To obtain U |0)" with 
a probability of at least cm as a result of a suitable adiabatic computation of 
duration T and subsequent measurement, it suffices that 


15 ) 
Тео = = or L — оо. 8.203 
(am) ^ 6209 


Proof The probability to obtain U |0)" as a result of a suitable adiabatic computation 
and subsequent measurement satisfies 


To observe U|0)" after To observe To produce |I) 
Р < the adiabatic evolution $ = P U|0)" in the > x P with the adiabatic $ . 
with Hr (s) in (8.122) state |I) evolution Hr(s) 


We know from Theorem 8.23 that |Г) as defined in Definition 8.18 is the ground 
state of the final Hamiltonian in the adiabatic computation designed to approximate 
U. From Corollary 8.4 we know that if the time T for the transition from Hini to Hg 


satisfies esti 
„~ OX) 


B VI = ртіп’ 


then the probability to find |Г) at time tg; = T + tin is bounded from below by ры, 
that is, 


(8.204) 


To produce |Г) 
P + with the adiabatic > > ры. 
evolution Нт (5) 


Moreover, Lemma 8.24 tells us that measuring a suitable observable in the state |I") 


will project onto the state U |0)" with a probability of LTD that is, 


To observe 1 
P< UJ0)" inthe } = TIT 
state |Г) de 


Consequently, (8.204) implies 


To observe U |0)” after 
P < the adiabatic evolution 
with Hz (s) in (8.122) 


> Pmin . 
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Combining Lemma 8.27 with Theorem 8.30 shows that for L > 8 in the case at hand 


Co(1) < r+ 7201", (8.205) 
“MY 
(8.168),(8.191) 


Finally, we see that for an adiabatic transition time T = T (L) satisfying 


CU) > 80016 T(L) < 1000L° ( L6 ) 
У1 Pmis >= Vİ — Prin B vl — Pmin vl — Pmin 


both (8.203) and (8.204) hold true. 


From Theorem 8.31 we see that if we repeat the adiabatic computation O(L) 
times, we will obtain U|0)" with a probability approximately bounded from below 
by риш. We can thus replicate the result of the circuit U with a given minimal 
probability by repeating the adiabatic computation O(L) times such that the total 
replication has an aggregated running time of O (17). Consequently, a circuit based 
computation can be efficiently replicated by an adiabatic computation. 


8.6 Replicating an Adiabatic by a Circuit Based 
Computation 


In this section we show that any adiabatic quantum computation can be efficiently 
approximated with arbitrary precision by a circuit with sufficiently many gates [33, 
114]. More precisely, we assume that we are given an adiabatic quantum computa- 
tion with initial Hamiltonian H;,; at time tini and final Hamiltonian Hg, at time tg, 
with a linear schedule such that with T = tfn — fini the Hamiltonian 


t — fini t — fini 
H(t) = ( — ==) Hini + "m Нап (8.206) 
generates the adiabatic time evolution U (t, tini) as solution of the initial value prob- 
lem j 
1—0 (t, tini) = H(f)U(t, tini 
E ( 7 ini) ( ) ( , ini) (8.207) 
U (tini; fini) = 1 


for t € [б и, tfn]. To show that U (tgn, fini) = Ur (1) can be obtained by a circuit based 
computation, we first approximate U by a time evolution Ü generated from a piece- 
wise constant Hamiltonian H. In a second step we approximate Ü further by a time 


evolution Ü generated by Hini and Hg; acting independently. 
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The approximation of U thus obtained will be shown to be efficient in the sense 
that the number of gates required to reach a given precision only increases as O (Т?) : 
Let J € N and At = Т. For j € No such that 0 € j € J we define 


^ ^ jAt jAt 
Hj := НА!) = ( -1 ) Hini + Hin 
= (1 » i) Hini + 7 Hia. (8.208) 


Moreover, we define к : [fini, tan] — No as 


k(t) = "© ES E Wisal (8.209) 


where 
[-]:R—Z 
x — min{z € Z|z>x} 
such that [x|denotes the smallest integer not less than x. With the help of H |; and к 
we then define 


A(t) = Rig. (8.210) 


Note that since K (tini) = О and K(tin) = J, we have 


> 


т 


(fii) = Bi = Ho = Н 
A (tin) = Peas) ES B, — Ha, 


and that A(t) is constant whenever ini d No. 
We begin our effort to approximate the adiabatic time evolution with a lemma 
giving an estimate of how far two time evolutions can drift apart given a bound on 


the difference of the Hamiltonians generating them. 


Lemma 8.32 For t € [tini, tin] let Ha(t), Hg(t) € BsdH) be two Hamiltoni- 
ans on a HILBERT space H, and for X € {А,В} let Uy (t, tini) be the respec- 
tive time evolutions they generate, that is, for X € {A,B} and t € [tini, tfn] we 
have d 
b Ох (t, tini) = Hx (£)Ux (t, tini) (8211) 
Ux (tini, tini) = 1. 


If 
||Ha(r) = Нв(т)|| < € (8.212) 
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holds for t € [tini, tfn], then we also have for such t that 


Wea a) = Mfr regn © a ec Tetra (8.213) 


Proof To begin with, we have for any |y) c H 


|| (Ua (t. tini) — Us(t, tini)) v ||. 
=, ((Ua(t, tini) — UB(t, tini)) y| (Ua (t, tini) — UB(t, tini) ) v) 
(2.5) 


=, ||Ualt, ts) vll? + Ов (2, ts) WII? (8.214) 


—(UA(t, tini) V|Un(t, fini) V) — (Un(t; tini) YU A(t, tini) V) 


ge. d Iw]? — (Ua (t, tin) V|U (t. tini) V) + (Un (t. tii) МОА (t, tini) V)) - 


(2.37) 


Next, we note that 


а (Walt, tis) Ов (t, tnt) V) 


v 

(< ОА (t, tini) V |Un(t; tini) W) + (Ua (t, fini) V| 5 06 fini) V) 

up w Ha(t)UA(t, fii) V|Un(t, fini) V) + (UA бы — iHg(t)U, B(t, fini) V) 
(8.211) 


= i(UA(t tin.) W| (Ha (t) — Ha(t)) Un(t, tini) v) , 


where in the last line we have used (2.4), (2.6), and that HA(1)* = H4 (t). Integrating 
on both sides then yields 


(Ua(t, tini) V|Un(t, tini) V) 
=  (UA(tini, fini) V |Un(tini; fini) V) 
+i | (Ua(s, tini) w|(Ha(s) — Ha(s)) Uz(s, fini) V)ds 


Tini 


= ПИР +1 d (UA( 5, fini) V| (Ha (s )- Нь (ѕ)) Un(s, tini) v)ds . 
rad 


Likewise, we have 
(Un(t, tini) V|UA(t, tini) V) 
t 
= |? +i f. (Uns, ti) (Ho) — HaG)) Ua Gs ii) )ds 


ini 
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such that 


(Ол (t, tini) V|Un(t, tini) V) + (Un(t, tini) V|UA(t, tini) V) 
= 21и 


+1 "n (Ua (S, fii) V| (Ha(s) — Ha(s)) Un (s. tini) vr) ds 


n (Ив (5, ti) w|(Ha(s) — Ha(s))Ua(s, ti) yds. ^ (8.215) 


ini 


Inserting (8.215) into (8.214) yields 


|| (Ua (t, tini) — Up(t, tini)) v||- = lll (ua. in) = Ug(t tint) vll | (8.216) 


= if (Ua (s, tini) Wl (Ha (s) — Ha(s))UB(s, tini) V')ds 


lini 


+ if (Ов(5, fini) V| (Has) = Ha(s))Ua(s, tini) V) ds 


ini 


< [ | (Ua(s, tini) W| (Ha (s) — Ha(s)) Un(s, tini) v) | ds 


«f (Us (s. tins) | (Ha(s) — Ha (в) Ол (з, fii) v) | ds. 


Tini 


In the last two lines of (8.216) we can use that, for example, 


(UA (s, tini) w| (HA (5 je pr fini) y)| 


€ ||Ua(s, fini) Wl || (Ha(s) — Ha(s)) Uns. пи) | 
(2.16) 

< ||Ua(s, tini) wll |Ha (s) — Нв(5)|| ||Un(s. tini) V| 
(2.51) 
=, || ПНА) — Нв(5)|| 

(2.37) 

< E: 

< Ily] 
(8.212) 


and, likewise, for | (Ug(s, tini) v| (Ha(s) — Ha(s))Ua(s, tini) у) |. Using this in (8.216) 
gives 


t 
| (Valt, ti) — Unt.) и? < 2lvI e / ds = Iw? 20 ае. 


The claim (8.213) then follows from the definition of the operator norm (2.45). 
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In order to apply Lemma 8.32 to our situation, we need an estimate of the differ- 
ence between H(t) and H(t). Exercise 8.115 provides this. 


Exercise 8.115 Show that H(r) as defined in (8.206) and H(t) as defined in (8.210) 
satisfy 


^ 1 
|| (+) — H(t)|| € у Pas = His] ; (8.217) 


For a solution see Solution 8.115. 


Whereas the result of Exercise 8.115 shows us how much the time dependent Hamil- 
tonian H(t) of the adiabatic quantum computation differs from the piece-wise con- 
stant A(t), the statement in Lemma 8.32 tells us how much the time evolutions they 
generate differ. We combine these two results to obtain a first approximation of 
U (tg, fini). 


Lemma 8.33 Let Br) be defined for t € [tii tg] as іп (8.210) and let 
Ü (t, tini) be the time evolution it generates, namely, 


d a E 
1—U (t,t = H(t)U (t,t 
Ul (t, tini) (т) (t, tini) (8.218) 
Ü (tini, tini) = 1. 
Moreover, with J € N and At = dl define 
Ü,:—1 
Ое) (8.219) 
М := max{||Hinil| 5 |Н), (8.220) 
where А; is as defined in (8.208). Then we have 
Ü (tin, tini) = Uy0y-1--- 010 (8.221) 


А МТ 
ПО tns tint) = O (Hin, tini)|| < 200 —— = 2VMAr, (8.222) 


where, as before, T = tfn — tini. 
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Proof To show (8.221), we note that for t €]tini + (k — 1)At, fini + KAT] we have 


K(r) =k € (1,...,J) and thus A(t) = Pic) = Hg, in other words, inside of each 
of these time periods of length Ат the Hamiltonian A(t) is constant. We define 


Û (tinis fini) = 1 


: | ‚ | (8.223) 
О (t, tini) = епн (0) 0а) ао, Uo fort €]tini, tin] 


and show first that Ü (t, fini) thus defined is a solution of the initial value problem 
(8.218). For t є| + (k — 1)At, tini + KAt] we have 


O(t, tj) = е0 7 DAD ТО (8.224) 
апа k = x(t) such that 


.d ^ А55 ^ A 
bg U fii) = НО (t, fini) = Н) (t, tini) 


At the discrete points tini + kAt, where € {1,...,J}, we use the left-derivative 


‚а^ ИЕ A 
igle tint) |t Ann tkAt = EN 8 (00 + kAt, tini) — Ü (fini + KAT 0, tni)) 
ПК iss EA R 
= ilim z _ Ес Ww 
(8.223) 
1 5 зА 
= іа — (1 = юй.) 
кш 5 е Ur +++ Uo 
(8.223) 
= NA + Uo 
=, Ĥ(tini + KADÜ (tini + KAt, tini) 
(8.210), 
(8.223) 


Hence, U (t, fini) is a solution of the initial value problem (8.218). Since «(fini + 
kAt) = k, we obtain 


Ü (tini T KAt, tini) == ge d Ü, — 0, ane -U; 
(8.224) (8.219) 


and ultimately 


A A 


O (tin, fini) = 0:01. 
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To show (8.222), we note that using the result (8.217) in Exercise 8.115 and applying 
(8.213) of Lemma 8.32 to U (fg, fini) and Ü (tän, tini) yields 


A 2(tan — fini 
П (а, fini) — O (tin, аа) = y Lx ini) |на — Н. (8.225) 
(8.217),(8.213) 


Using T = tfn — fini and 


|| Hin = Hinil| [Has]] + ||Hini]] € 2M 
Se 


< 
чар 
(2.53) (8.220) 


in (8.225) implies ће stated claim (8.222). 


Having approximated U (tfn, tini) by the product Û (thin, tini) = Uy -- б of the Ü; 
defined in (8.219), we now proceed to approximate each Ü; in turn by 


Ü; = eir (1-5) Hini iar Hs (8.226) 
and Ü (ња, fini) = Ü, sers Ü, by 
Deo. (8.227) 


The 0, will be our gates апа Ü will be the circuit with which we approximate the 


adiabatic evolution. Note that the unitary factors U; are akin to a time evolution 
generated by first Hg, and then by Hi, separately each for a period of At. More 
precisely, let Он, denote the time evolution generated by Hx for X c (ini, fin}, that 
is, the Uy, are the solutions of the initial value problem 


Then we can express the Ô, of (8.226) as follows 


A j J 
Uj = Он: С 2) Un, (aż) х 


This shows that we can construct the gate Ü; by first subjecting the system for a time 
Ath to the time evolution generated by Hg, and subsequently for a time At (1 = i) 


to the time evolution generated by Hini. 
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Also note that since Hini and Hg, do not necessarily commute,? we have in gen- 
eral 


Ü; — = e iar(i- j)n ini girs 5 Hin xe i(Ar(1— L) Hii tard Hin) — Û;. 


Even though Ü; and 0, differ, we can give bounds on their difference, as the 
Theorem 8.34 shows. 


Theorem 8.34 ([117]) Let A and B be bounded operators on a HILBERT 
space H. Then the following hold: 


ehe] — BL = ell (A+B) Bje"B du (8.228) 
ПСЕ " e 

1 
[К = еле? || E > ||[A, В]|| е!!! " (8.230) 


Proof То begin with, we have 


efe _ еА+8 = ед е(1- и)(А+В) ен |: s (8.231) 
where we used the notation f (u) ha := f (b) — f (a). It follows that 
efe? _ | е(1- и)(А+В) е") аи 
ite 


(8.231) 


_ 1 Mon — e^ (A + B)e(1 70448) gu ut eA (I4 рен) dy 
0 


_ e (Ael =A) _ (A + B)e! u)(A+B) 4 e(1-u)(4 *B) edu 
0 
= КС (1-и) (4+8) р _ Bell- (A+B) ) eB ay 

0 

1 
= e 

0 


"Ale (1—и AB). gleuBgy, , 


3If they did commute, then there would exist an ONB of eigenvectors for both operators. In this 
case preparing an eigenstate of Hini, which is the starting point of the adiabatic algorithm, would be 
the same as preparing an eigenstate of Нь, which is the desired end-state we would like to obtain 
with the algorithm. Hence, there would be no need for any algorithm. 
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where we used that Ae"^ = e"^4A holds for any и € C and bounded operator A. This 
proves (8.228). In order to show (8.229), we use that 


[e^, В] = е Ве(1-9/ |81 (8.232) 


to write 


d 1 
= zu — (e^ Bel (1—u)A )du = J (ac^ Bel -04 — ейде) аи 
pra du 0 


I 


Г С (1—u)A — eM gAe(1-14) du 
= [| e"^[A, B]e7)^qy . (8.233) 
0 


From this follows 


1 
eB] =, |f. eta, setas 
—— 0 
(8.233) 
1 
< ] |n met du 
М Jo 
2.53 
1 
< f Пети, sy [79^ au 
М Jo 
2.52 


| еч ура, By] ейди 
0 


| (^ 


= _||[4,B]|| e^! , 


which proves (8.229). Finally, to show (8.230), we first note that 


| [7969,31 | « || (1 — u)(A + B), B В| || e! (1—u)(A4-B)|| 
(8.229) 
(1 — u) || [A, B] || et :201411-181) . (8.234) 
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Finally, we have 


(1—u)(A4-B) B] e"? du 


! А 
1 E 
0 


|[e^** — ee || = T 
(8.228) 
< rà | eh e(1—0(A-B) B]e"? |du 
~~ Jo | 
(2.53) 
7 [ |le"^ || | [e (17:048). gi | |le"?|| аи 
0 


f е' А (1 — u) || [A, B] || et» В) enl BI, 
0 


= || [A, B] дн! f. a jas 


1 
= sli, B]I| elatio, 


proving (8.230). 


The claim (8.230) of Theorem 8.34 allows us to find bounds on the difference of 
the Ü; and Ü; and eventually Ü and Uj. 


Corollary 8.35 Let Uj, U,J,T,At and M be defined as in Lemma 8.33, and 


let 0, and Ü be defined as in (8.226) and (8.227). Then we have the following 
bounds: 


A A i f P 2 2MT 
lo- || < 56) 1н, На |е (8:235) 


^ A T? 2MT 
| (eins tnt) eS oy Ib ems dmm (8.236) 


Proof 'To prove (8.235), we apply (8.230) of Theorem 8.34 to 


А = ilt ( " i) Hini and B= —iAt Hin (8.237) 
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such that 
SOL et (If) Mini} 140 нь, = 0, 
ари =” J 
(8.237) (8.219),(8.208) 
i LOB xu A 
efe? = edt (IF) Hini -iti Hin = Ô, . 
“MY 
(8.237) (8.226) 


Consequently, we find 


E (1 1) ard] || [Hini, Нал] || el4t (1-4) esit [на 


1 СИС, 

< 54° I| [Hini, Han] || eA Чї! +I Min I) 
LTY 2 
5 (7) ПН, Hin] l e 7. ; 


where we used 0 < 7 < 1 in the second line and At = т as well as the definition 
(8.220) of M in the last. This completes the proof of (8.235). 


To show (8.236), we first deduce that 


Ü (tin; tini) -Ü 


= 0;---0,-0,---61]| 
| | J 1 J 1 
(8.221),(8.226) 


< 102-0001 01) || + ||(G--- th 0-02) 01| 

м 

(2.53) 

< Os -Oall ||01 - ôi || + ||Or--- 02 — Â --- Âa ô || 
(2.52) =1 icd 


^ 
А 


й\-й\| + [0s -02 - Ôr -+ -Ô 


Repeating this with |9 05 — Ur. -ô| and so on, we obtain 


^ J 
| Can tin’) - 0 <5 (8.238) 
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For the terms |0, = | on the right side of (8.238) we use the bounds given in 
(8.235) to arrive at 


[|Ó tios һы) -Ü 


ТРГУ" 2MT. 
< ў g (5) Ihi Hale” 


Т? 2MT 
EL [| [Hini Hän] |e 7, 


which completes the proof of (8.236). 


Recall that U (tfn, fini) as defined in (8.207) is the adiabatic time evolution which 
we want to approximate by a circuit. For the approximating circuit we choose Ü = 


Ü, Uj comprised of the J gates Ü;. We can then combine (8.222) in Lemma 8.33 
with (8.236) of Corollary 8.35 to obtain a bound on the quality of the approximation 


of U (tin, fini) by Û. This result will also enable us to state how J has to increase 
as a function of T = tin — fini and ||Hini|| and ||Hgn|| in order to achieve a desired 


precision of the approximation of U (tfn, fini) by Йй. 


Theorem 8.36 Let U(t, tini) be defined as in (8.207), and J, T and M as in 
Lemma 8.33. Moreover, let U = U;---U, be the circuit comprised of the J 
gates Ü; as given in (8.226). Then we have 


D 
MT (MT 
ROT EU GR Р (8.239) 


In particular, if we choose J € N such that 


| |U (tin 179) Ta Û 


2e 2 2 
Л > (2) тах {2мт, (мт) } | (8.240) 


where ô € R is such that 0 < 6 < 1, then we have 


(л =(@|\ < ®. (8.241) 


Proof In order to show (8.239), we note that 


496 
[|U tis. гы) = U = [|U tios tn) m Ü-Ü- Ü 
< ||U (ta; fini) — O T 0-0 
же 
(2.53) 
MT T? 2MT 
< 2 -y + zy || [Hein Hini] [|e 7 . 
(8.222),(8.236) 
Using that 
|| [Figs Hini] || =, [Hi Haar — Higgs]. S [Hn inal | + Нн 
(2.46) (2.53) 
< 2 1н Пн € 2M? 
wy 
(2.52) (8.220) 


then completes the proof of (8.239). 
Choosing J as in (8.240) implies 


(2) ema | 


and since 0 < 6 < 1 thus 


J 2e 2e 
MT 2 2МТ 2 zi 
J J ^ 2e 
(мт)? 5\2 
1 
Ј ^ e 2е i 


Using (8.242), we can bound the right side of (8.239) as follows 


MT (мт)? эмт 
< 24/—— + e J 
= “ү у J 


[|U (tans fini) – 0 


(8.239) 
$ $ $ 
< 2— + —е= (2+е) 
“YH 2e 2e 2e 
(8.242) 
< 6, 


which completes the proof of (8.241). 
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(8.242) 
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Theorem 8.36 tells us that a given adiabatic evolution U(T + fini, fini) can be 
approximated up to an error of ô by a circuit Ü of J gates, where J € o((5)’). 


In other words, the number of gates that we need to replicate an adiabatic evolu- 
tion U(T + fini, fini) up to a desired precision 6 growths at most quadratically as a 
function of T. Therefore, an adiabatic computation can be efficiently replicated by 
a circuit based computation. 


8.7 Further Reading 


A rigorous proof of quantum adiabatic theorems with a view towards application in 
adiabatic quantum computation can be found in the paper by JANSEN et al. [111]. 
Their proofs apply to infinite dimensions as well and contain the optimization result 
for the schedule in the adiabatic GROVER search. 

Combining quantum adiabatic computation with another field of much recent 
interest, PUDENZ and LIDAR [118] investigate using the adiabatic method in the 
context of machine learning. 

Related to the adiabatic method is the idea of quantum annealing, which is 
described in more detail by DAS and SUZUKI in [119]. This is a method which 
derives from the classical simulated annealing methodologies. It makes use of quan- 
tum tunneling, which is not available in the classical annealing version. 

For a most comprehensive, detailed and up to date overview of almost all aspects 
of adiabatic quantum computing we recommend the recent review by ALBASH and 
LIDAR [114]. This review also contains a summary of the history as well as an 
extensive list of further references pertaining to the various sub-branches of adia- 
batic quantum computing. 


Chapter 9 A) 
Epilogue m 


The physical phenomena of quantum mechanics have been extensively investigated 
and experimentally verified long before the advent of quantum computing. Indeed, 
it is a perhaps justifiably widely held opinion, that quantum mechanics is the best 
tested physical theory ever. The example of the EPR paradox, however, shows 
that a certain discomfort about the apparently counter-intuitive character of quan- 
tum mechanics could be found among scientific prominence. Even BOHR has been 
quoted as saying *he who is not shocked by quantum mechanics has not understood 
it? 

Perhaps nowadays it would be too strong to use the term discomfort or even 
shock, but the opinion that we do not really understand quantum mechanics was 
said to be shared by FEYNMAN, one of the founders of quantum computing. Such 
epistemological doubts are viewed by some as unnecessary distractions—a view- 
point often expressed by the slogan ‘shut up and calculate.’ And calculate they do! 
Despite it ‘being impossible to understand’ innumerable applications have emerged 
from it, and it is hard to overestimate the influence quantum mechanics has had on 
our daily lives. 

It remains to be seen if quantum computing is yet another addition to the suc- 
cess story of quantum mechanics. The theory we have presented here is sound and 
promising, but much remains to be done before we will see a significant impact of 
this new paradigm of computing. Certainly, reliable physical realizations still pose a 
formidable challenge, although the race is on, and many big corporate players have 
joined it. 

But also on the theoretical side work remains to be done. Although after the 
algorithms by SHOR and GROVER many more have been added such that there is 
now a well populated zoo [95], it is fair to say their generalizations, such as the 
hidden subgroup problem and amplitude amplification, make up the bulk of quan- 
tum algorithms. For many problems quantum algorithms with significant efficiency 
gains over hitherto existing classical algorithms have yet to be found. One obsta- 
cle for this may be that the practitioners attacking these problems are not aware of 
the possibilities a quantum computer can offer. Hopefully, this book can make a 
contribution to alleviate that. 
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In the previous chapters we have tried to provide the basic mathematical con- 
cepts and elements for quantum computing. As we have seen, the theory of quan- 
tum computing rests on exploiting phenomena of quantum mechanics combined 
with suitably adapted results from various branches of mathematics. In fact, one of 
the appealing aspects of quantum computing is that it uses results from, inter alia, 
real, complex and functional analysis, linear algebra, group, number, complexity 
and probability theory and at the same time has at the heart of it physical phenomena 
that challenge our understanding of reality and reach into the realm of philosophy. 
This multitude of intellectual challenges, paired with the potential effect any suc- 
cessful implementation can have on our everyday lives, makes it an attractive field 
of study indeed. 

It is the hope of the author that this book will entice the reader to take up the 
challenges and to contribute to make quantum computing another big chapter in the 
success story of quantum mechanics. 


Appendix А 
Elementary Probability Theory 


The mathematical concept of probability builds on some basic measure-theoretic 
notions, which we exhibit first. 


Definition A.1 Let Q be a non-empty set and A С {B| B C Q} a set of sub- 
sets of Q. The set of subsets А is called o-Algebra on Q if 


QEA 
ВЄА => О- BEA 


U An € A for every sequence (An) ey with A, € A 
ncN 


holds. The pair (G2, A) is called a measurable space. A measure on (Q, A) 
is a map и with the properties 


и:А = [0,5] 
u(0) = 0 
for every sequence (А), эі An € A 


«(U^ = Y uA) and A, ПА» = 0 for all n Z m. 


neN neN 


The triple (Q,A, 1) is called measure space. 

For i € {1,2} let (Q;, A;) be two measurable spaces. A function f : О — 
О» is called measurable if for every A € A» its pre-image f^! (A) := {о € 
О | f(@) € A} satisfies f^! (A) € A1. 


By definition every measure takes only non-negative values. If a measure is such 
that on the complete set Q it takes the value 1 (and, consequently, takes only values 
in [0, 1]) it becomes a probability measure. 
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Definition A.2 A measure P on a measurable space (Q, A) is called proba- 
bility measure if 
Р(О) = 1. (A.1) 


The triple (Q, A, P) is called probability space. 
A probability space enables us to define what is called a random variable. 
Definition А.З Let (OQ, A,P) be a probability space and (М, М) a measurable 
space. An M-valued random variable Z is a measurable map 
Z:2— M. 

The probability measure 

Р; := PoZ ! : M [0,1] 
on (M,M) is called probability distribution (or simply distribution) of Z. If 
the image of Z is countable, that is, if there exists an index set J C N such that 


Z(Q) = (mi| i € I}, then Z is called a discrete random variable. In this case 
Pz becomes a discrete probability distribution, which assigns a probability 


Pz((mj) = PoZ '({m}) 


to every m € Z{Q}. 


For every subset S C M satisfying 5 € M the real number 
P(S) = Р({®| Z(o) € 5}) 
is called the probability of the ‘event’ Z(@) € S taking place. To emphasize this, we 


will often write P (Z € S} for Pz(S) or, in the case of a discrete random variable, 
P (Z = m} for Pz((m]). 


Example A.4 Let (Q,A,P) be a probability space and let (IR", B) be the measure 
space, where B denotes the BOREL sets of IR". Then any measurable function Z : 
Q — R” constitutes an n-dimensional real-valued random variable. This means that 
to any BOREL set B € B we can assign a probability Р{0 | Z(@) € В}. 
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Definition A.5 Let Z be an n-dimensional real-valued random variable on a 
probability space (Q,A,P). The expectation value of Z is defined as 
E[Z := / Z(o)dP(o) = / ХР), (А2) 
Q R” 
where 2Р2 (x) is often (in particular when n = 1) written as P {Z € [x,x + dx] }. 


In case Z is an integer-valued discrete random variable with Z{Q} = {x;| i € 
I) C Z, the expectation value is given by 


E [2] = Е {Z = xi} . (A.3) 


iel 


As can be seen from the right side of (A.2) and (A.3), the knowledge of Q,P 
and Z(q@) is not required to calculate the expectation value as long as one knows the 
respective probabilities P (Z € [x,x+ dx]} or, in case of a discrete random variable, 
Р {7 = xi}. 


Lemma A.6 Let Z be an integer-valued random variable on a probability 
space (Q,A,P) satisfying 
|Z(@)| € c (A.4) 


for all œ € О and some non-negative c € R. Then we have |E [Z]| < c. 


Proof 
EIZ] = | Xx P(Z-xj| < Y uP(Z— xi} = È |P {Z = x) 
viel icl icl 
(АЗ) 
< X cP{Z= xi} = ey PI —xj = с 
Ум геї icl ү 
(A.4) (A.1) 


If Z is an n-dimensional real-valued random variable, then for every BOREL mea- 
surable function f : IR" — R” the function foZ:Q — IR" is also an m-dimensional 
real-valued random variable. Its expectation value is given by 


Е[/(@]= [ /(®(®))4Р(®) = | 70да). (A.5) 
Q 
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For discrete random variables one has analogously 


E[f(2)) = Y f(x)P(Z- x) . (A.6) 


icl 


Definition A.7 Let 4; and Z2 be one-dimensional real- or integer-valued 
random variables. Their variance var[Z], covariance соу[21,2:] and 
correlation cor[Z; , 72] are defined as 


var[Zj] := E [(Z; -E[Z]]?] 
cov[Zi. Z5] := E[(Zi - E[Z1]) (Zo — E[Z2])] 
сог[71,72] := ы 


v/var[Z] var[Z2] ' 


As can be seen from (A.5) and (A.6), the calculation of the expectation value 
of a function of several random variables Z;,2Z»,... requires their joint distribution 
P{Z, € [ху,ху + dx], Zo € о, о + dx], ...) or P{Z, = ху, = x»,...] for discrete 
random variables. This holds, in particular, for covariance and correlation of two 
random variables. 


Appendix B 
Elementary Arithmetic Operations 


The following lemma formalizes the algorithm for the binary representation of the 
addition of two numbers. It is a binary version of the elementary textbook addi- 
tion of numbers in decimal representation and is implemented with the quantum 
adder defined in Sect. 5.5.1. The functions n and a mod b used here are defined in 


2 
Definition D.1. The binary sum a © b = (a+b) mod2 was introduced in Defini- 
tion 5.2. 


Lemma B.1 Let n є N and a,b € No with a,b < 2" have the binary repre- 
sentations 


п—1 | п—1 А 
a=) a2), p=) ФИ, 
j=0 j=0 


where aj,b; € (0,1). Furthermore, set ду := 0 and 


a; itb ire 
et | J - j ] for j € (1,...,n] (B.1) 


20 2 et А 
sj = aj Obj OE; for j € (0,...,n—1]. 
Then the sum of a and b is given as 


n-l 
a+b= У 52) +612". 
j=0 


Proof We prove the claim by induction in л. For the induction-start we consider first 
the case n = 1. Let a,b € {0,1} such that a = ag, b = bo and a; = 0 = bj. Then we 
have 
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m 2 
2 


This proves the claim for и = 1. 
For the inductive step from n to n 4- 1 suppose that the claim holds for п, that is, 


п—1 
a+b= У 2) +612". (В.2) 
j=0 


For ã = a+ G,2” and b = а+ 0,2" their binary representatives д j and b j satisfy for 
j€(0,...,n- 1} 


and thus 


Кур а] 2 
(D. 77 

=! i. 3 Gn +, +ê 

m z A 1 
- LOUPE OLET D iv | E 1 | 
mS m — 
= 

п 
= Ns t. 

j=0 


Because of бу :— 0 апа (B.3), we then have 


йр буа Бс 
Е T 7 ] for j € (1,...,n4 1] 


"nm | 
5) =й; Obj Өс} for j € {0,...,n}. 


This shows that the claim also holds true for n+ 1. 
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The carry terms е; of the addition defined in (B.1) can be written in a form 


avoiding the explicit use of | | and more suitable for direct implementation by a 
quantum adder. 


Corollary B.2 (Binary Addition) Let n € N and a,b € No with a,b « 2" have 
the binary representations 


n-1 | п—1 | 
ues b= `$ Б”, 
j=0 j=0 


where aj,b; € {0,1}. Furthermore, set су := 0 and 


dba 2 ү? db ; 
cj t= aj-ibj i 6 aj6j ® bj усу 1 for j € {1,...,п} 


D E : 
sj = aj Obj Ge; for j € (0,...,n— 1). 
Then the sum of a and b can be written as 


п—1 
a+b= У sj2/+cf2". 
j=0 


Proof Because of Lemma B.1 it suffices for the proof of the claim to show that for 
j €{0,...,n} we have c} = ё}. We show this by induction in j. For j = 0 it holds 
by definition. For the inductive step from j — 1 to j suppose that zu = E. It 
remains to show that then 


2 2 aj it bj i 6i, . 
cj = азл aj aci Sbjct = | 2 J = ёў (В.4) 
holds. 
The carry terms GH can only assume the values 0 or 1, as we begin with e, =0 


à; 414b; +ét 
and then have successively 0 < aes a) < 3. The proof of (B.4) is given by 


simply evaluating all possible combinations of the left and right side and verifying 
equality. This is shown in Table B.1. 


The following lemma formalizes the algorithm for calculating the difference 
between two numbers in the binary representation. 
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Table B.1 Value table for the proof of (B.4) 


aj bj-1 ea cj —ajabji é ajc} Фф ёі = 
Брас мч 
2 
0 0 0 0 0 
0 0 1 0 0 
0 1 0 0 0 
0 1 1 1 1 
1 0 0 0 0 
1 0 1 1 1 
1 1 0 1 1 
1 1 1 1 1 


Lemma B.3 Let n € N and a,b € No with a,b « 2" have the binary repre- 
sentations as given in Lemma B.1. Furthermore, set ёо :— 0 and 


bj-1—aj-1 PELI 


j= | 2 | for j € {1,...,п} 


du (bj —aj4-6;) mod2 for j€ {0,...,n— 1}. 


Then the difference between b and a can be written as 
b-a= Y d +6,2". (B.5) 
Proof We also show this by induction in n. For the induction-start we consider at 


first the case n = 1. Let a,b € (0,1) such that a = aọ,b = Бу and a, = 0 = bı. Then 
we have 


bo — 
р-а = bo — ag = (bo — ao) mod 2 + | : = 2 


= do 642, 


which proves the claim for n — 1. 
For the inductive step from n to n+ 1 suppose that the claim holds for n, that is, 


п—1 
ь-а= У dj «6,2. (B.6) 
j=0 
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Бога = a 4-42" and b = b + b,2" it follows for j € (0,...,n — 1} that 


and thus 


Б-а = b—-ac(b,—à,)2" 


=, У, 4,2) + (b, — à + 6, )2" 


PEE А b,—à,--6; 
dj2i + (0, — än +7) mod2+ E 2)2" 


T xd Fi Bn — Gn 9m 
= Y, dai + ((ф,—а, +ё)тоаз)э"+ AES | уун 
= eii 
=4, 


Sent 


n 

JJ = п+1 
У, 42 +2, 
j-0 


where we have бу :— 0 and, because of (B.7), also 


M bi = 3-1 +21 | 
| 2 for j € (L,...,n4 1] 


^ 


d; = (bj-4j+é;)mod2 ^ forje(0,...,n). 


This completes the proof of the claim for n+ 1. 


In contrast to the addition, the carry terms ё; in the subtraction can become nega- 


tive. Moreover, for two numbers a, b < 2” the highest carry €, provides information 
whether Ь > a or b « a, as Exercise B.116 shows. 


Exercise B.116 Letn € N and a,b € No with a,b < 2" and 6; and d; be defined as 
in Lemma B.3. Then the following hold: 


(i) 
6; €(0,-1) 


С; |. 


and thus ĉ =- |6) 
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(ii) In particular, we have that 


(B.8) 


For a solution see Solution B.116 


The subtraction algorithm can be formulated without negative carries. In preparation 
for this we first prove the following lemma. 


Lemma B.4 Let n € N and a,b € No as well as 6; and d; as in Lemma B.3. 
Then the following holds 


СЕ 


2 2 2 
| = (165)(ua e la|) Sailele eo 


(B.10) 


Proof 'The simplest way to prove both (B.9) and (B.10) simultaneously is by direct 
evaluation as shown in Table В.2. 


With the result of Lemma B.4 we can formulate the subtraction algorithm in a 
form which is akin to the inverse quantum adder. 


Corollary B.5 (Binary Subtraction) Let n € N and a,b € No with their binary 
representations as in Lemma B.1. Furthermore, set cy :— 0 as well as 


Table В.2 Value table to prove (B.9) and (B.10) 


Proof of (B.9) Proof of (B.10) 
aji |bji | Gy Су (1 b)-1)(aj-1 6 dj a; & bj |е 
ёа jê àj-i 6j 4 
0 0 0 0 0 0 0 
0 0 -1 1 1 1 1 
0 1 0 0 0 1 1 
0 1 —1 0 0 0 0 
1 0 0 1 1 1 1 
1 0 —1 1 1 0 0 
1 1 0 0 0 0 0 
1 1 —1 1 1 1 1 


Appendix B: Elementary Arithmetic Operations 511 


Proof From (B.9) and (B.11) we see that 


formula. Since both start with the value lé | = су = 0, it follows that for all j € 
{1,...,n} then 


6; and c; satisfy the same recursion 


c= lez nu (B.14) 
holds. From this and from (B.10) together with (B.12), it thus also follows that for 
all j € (1,...,n) then d; = d; holds. Together with (B.5) and (B.14), this implies 

п—1 | 
b-a= Y dj?! е2". 


j-0 


Applying (B.14) once more to (B.8) finally yields (B.13). о 


Appendix С 
LANDAU Symbols 


The input to many algorithms often contains a natural number N, the increase of 
which leads to an increase of the computational effort in the algorithm. For exam- 
ple, in the SHOR algorithm N is the number we want to factorize, whereas in the 
GROVER search algorithm N denotes the cardinality of the set in which we search. 

The growth rate of the number of computational steps in the algorithms is usually 
classified as a function of N with the help of LANDAU symbols. For these we use 
here the following definitions. 


Definition C.1 For functions f,g : N — N and in the limit N — œ the little 
LANDAU symbol o(-) is defined as 


F(N) € o(g(N)) for N = 
je VeeR, IMEN: VN» M. |/(М)|< ela(N)] 


and the big Landau symbol O(-) is defined as 


f(N) € O(g(N)) for N о 
«3C€eRandMeN: у> м |/(М)|< C|e(N)] . 


We say f is of polynomial order (or of order poly (N)) and write this as 


f(N) € poly (N) 


f(N)eO (> ow’) 


j=0 


for a finite k € No and some aj € R. 
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Apart from those given above, slightly modified or generalized definitions of 
these symbols can be found in the literature, but the above is suitable and sufficient 
for our purposes. 


Example С.2 By application of the L' HOSPITAL rule one can easily show that 


m 


exp(N) 


| Vm € N. 


This implies for all m € N: 


InN = o(iv^) and N” = o(exp(N)). 


Exercise C.117 Let f;(N) € O(g;(N)) fori € {1,2} and N — ee. Show that then for 
N — оо 
(i) 
AQ) + f(N) € O(|g1(N)| + lg (N)D) - (C.1) 
i) 
ЛОМ) AWN) € O(g(N)go(N)). (C.2) 


(iii) If there exists an M € N such that for all N > M we have |gi(N)| < |g2(N)|, 
then it follows that 
Fi(N) + f2(N) € O(gz(N)). (C.3) 


For a solution see Solution C.117 


Appendix D 
Modular Arithmetic 


Definition D.1 The integer part of a real number и is denoted by |u| and 
defined as 
[и] := max(z € Z| z < u}. 


Likewise, we define 
[u] := min{z € Z| z > u}. 


For a € Z the remainder of a after division by N € N is denoted by a mod N 
and is defined as 


amodN а s] N. (D.1) 


An immediate consequence of (D.1) is that for a € Z and N € N 


amodN=0 © dzeZ: а= :№, 


that is, a mod N = 0 if and only if N divides a. 


Exercise D.118 Show that for a,b € Z and N € N 
amodN —bmodN <= (a—b)modN=0. (D.2) 


For a solution see Solution D.118 
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The remainder a mod N is bounded from above by 5 and N as is to be shown in 
Exercise D.119. 


Exercise D.119 Let a, М € N with a > М. Show that then 
a mod N < min(5,N). (D.3) 


For a solution see Solution D.119 


Lemma D.2 For a,N — © the number of computational steps required for 
the calculation of a mod N scales as 


Number of computational steps 


2 
required to calculate a mod N = O((log, He SEN) ) d ip 


Proof Because of (D.1), the computational effort to calculate a mod N is given by 


the number of operations required for dividing a by N and determining | | Р 
which is of order O((log; max(a,N))?) 

+ the number of operations for the multiplication FI with N, which is of order 
O((log; max(a,N])?) 

- the number of operations for subtracting | | N from a, which is of order 
O(log, max(a,N]). 


Using (C.3), it follows that 


Number of operations to calculate a mod N € O((log; max{a,N p’) : 


Definition D.3 If, for a,b є Z, there is a z € Z, such that р = za, then a 
divides b (or one also says b is divisible by a). If no such z exists, a does not 
divide b (resp. b is not divisible by a). These two exclusive cases are described 
with the following notations: 


ajb > 3ze€Z: b=za 
ар = е2 b=za. 
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The extended EUCLID algorithm determines the greatest common divisor gcd(a, b) 
of two numbers a,b € N and a solution x, y € Z of 


ax + by = ged(a, b) 


in the following way. 
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Furthermore, one has 


т = ged(a,b) (D.10) 
n € 2min(log5a,log; b) 4-1 (D.11) 
T 1$, o rofa = gcd(a,b). (D.12) 


Proof Since we know from (D.3) that u mod v « v, it follows from the defini- 
tion (D.6) of the r; that 0 < r; < ғур, that is, the r; are strictly decreasing with 
increasing j. Hence, there must exist an n € N with n € min{a,b},r, > 0 and 
тл+1 = 0. This proves (D.9). 

In order to show (D.10), we first prove by descending induction that for all j € 
{0,...,n+1} az, ; Є N exists such that 


Гај = £n- jfn- (D.13) 
For the induction-start let n € N be such that 
ry > 0 but ља = 0. 


It follows that 


0—r = ry, 1 modr, = rg, — ined r 
п+1 п—1 п n— n- 
(D.6) 


Consequently, there exists а 2,1 :— E € N that satisfies 


Fn—1 = Zn—1Pn- 


Furthermore, one has per definition (D.6) that r, = rn—2 тойг, and thus 


Tn-2 Tn-2 
Tg—2 = Fn + Fn-1 = ( 1 + а) а-о 
I Y Th-1 
=: 


for a z, 5 Є №. This proves (D.13) for j Є {1,2}, and the start of ће descending 
induction is established. Next, we turn to the inductive step. We will show that if 
there exist z,_(j~1),Zn—j € N, such that 


Р (j-1) = Zn-(j-1)!n (D.14) 
Гј = Zn—jfn; (D.15) 
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then there exists а z,_(;+1) € N satisfying 


Tn—(j+1) = £n-(j4-1)^n- 


From the definition (D.6) of Tn (j-1) and the assumptions (D.14) and (D.15) it fol- 
lows that 


Fn—(j+1 Fn—(j+1 
Tn—(j+1) = l'n-(j-1) + | " s | Гј = (в-о-›+ | p | ini) ln 
SS —— 


Ка—] 
a ac N 
= п—(}+1)/т—1. 


This completes the inductive proof of (D.13). Hence, there exist 20,21 Є N, such 
that 


min{a,b} = ro = 207 


max{a,b} = т-у — z ira, 


and r, is a common divisor of a and b. 
To show that r, is the greatest such divisor, suppose g is also a common divisor 
of a and b. Then define à :— : € N and b :— i: € N. Applying the algorithm to d, b 


generates 7; :— a and thus ў, = 7 € N, in other words, any common divisor of a 
and b also divides r,. Consequently, ғ, is the greatest common divisor of a and b. 
This completes the proof of (D.10). 

To prove (D.11), we use that, because of r; < rjj, we can apply the esti- 
mate (D.3) from Exercise D.119 to definition (D.6) of r;. This implies 


rj < min( 7r, i). (D.16) 


Repeated application of this yields 


Fok-3 ri max{a,b} 
б ел с сш. 
12-2 ro = min{a,b} 
Ton < 2 < < 2k = 2k 


Because of r2k+1 < rog < Рк, we then have 


а b 
Pa] < Рд < mini оу, 2 
and thus 
Е min{a,b} 


= 
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Consequently, 


H > min{log, a, log, b} = rj —0. 


Since п per definition in (D.9) is the biggest number that still satisfies r, > 0, it 
follows that 


BH < min{log, a, log, b}. 


This in turn implies 
n < 2min{log, a,log,b} +1. (D.17) 


In order to prove (D.12), we show, again by a two-step induction, that 
r_8j+rotj = rj. (D.18) 


Induction start is given by j € (—1,0] because the defining equations (D.6)-(D.8) 
imply 


Y 15-1. Tof] = Р 


т_150-Е rof = ro. 


In order to verify the induction-step from j to j+ 1, we suppose that (D.18) holds 
for j and j — 1. Then it follows that 


т—18+1 rof г (5 ue зу) Fn (: ja tj) 
—1Sj+1 Блоб = —1(5у—1 j) +ro|tj-1 j 
jt jt j ғу |? j rj | 


(D.7),(D.8) 
rj-1 li-| 
" J J T 
= T-|Sj—| t l'ofj-1 | | (ris; t rot; ) = 131 | - |x 
r rj —— rj 
cre =r] 
= Fjl. 
Maer o 
(D.6) 


This proves (D.18), and the claim (D.12) follows from the case j — n. 


Example D.5 Table D.1 shows the values obtained in running the extended EUCLID 
algorithm for a = 999 and b = 351, yielding n = 3 and gcd(999,351) = з = 27. 
For a = 999 and b = 352 the numbers of the algorithm are shown in Table D.2. 
In this case we obtain n — 6 and gcd(999,352) — 1. 
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Table D.1 The extended EUCLID algorithm for a = 999 and b = 351 


m а = 999 1 0 999 
0 b = 351 0 1 351 
1 999 mod 351 = 297 1 =2 297 
2 351 mod297 = 54 -1 3 54 
3 297 mod 54 — 27 6 —17 27 
4 54 mod27 = 0 —13 37 0 

Table D.2 The extended EUCLID algorithm for a = 999 and b = 352 

/ г) tj as; + bt; 

-1 а = 999 0 999 
0 b = 352 1 352 
1 999 тоа 352 = 295 =? 295 
2 352 mod 295 = 57 3 57 
3 295 mod 57 — 10 —17 10 
4 57 mod10 = 7 88 7 
5 10mod7 —3 —105 3 
6 7mod3 = 1 —298 1 
7 3mod1=0 —999 0 


Lemma D.6 For a,b — © the number of computational steps required for 


the calculation of gcd(a, b) scales as 


Number of computational 
steps required for gcd(a, b) 


Proof From Theorem D.4 we see that for the calculation of gcd(a,b) with the 
EUCLID algorithm we need to compute expressions of the form и mod v, start- 
ing with a mod b as shown in (D.6). The number of computational steps for each 
calculation of a mod b grows according to Lemma D.2 as O((log; min{a,b})) 
for a,b — œ. From (D.11) we infer that in the EUCLID algorithm the number of 
times we have to calculate expressions of the form и mod v grows with a,b — оо 
as O(log, min(a, b)). The total effort for the calculation of gcd(a,b) is thus given 


by (D.19). 


€ O((log; min(a,b))?) . 


(D.19) 
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Exercise D.120 Show that for u,v,u; € Z and К,а, № € N the following hold 


(i) 
u(vmod N) mod N = uv mod N 


(ii) 
j=l 


k k 
(п uj moan) mod N = no mod N 
j=l 


(iii) 
(u* mod N)* mod N = и“ mod N 


v) 


Ms 


» (и; modN)) mod N — ( 2) mod N. 


1 


чм. 
ll 


For a solution see Solution D.120 


(D.20) 


(D.21) 


(D.22) 


(D.23) 


Next, we show the following useful lemma. 


Lemma D.7 Let a,b,c € Z and N € N with c £0 and gcd(N,c) = 1. Then 


we have 


amod N = bmod N е ac mod N = bc mod N. 


Proof We show — first: By definition, we have 


amod N = bmod N 


a b 
ib di НЕЕ N 
(D.1) 


(D.24) 


(D.25) 
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such that 
acmodN = ac— | м 
“NH N 
(D.1) 
_ aj |b bct (151-0) Мс 
= (Н I|) ve | = N 
(D.25) 


— bc— EIE — bcmodN. 
N М 
(D.1) 


Now, as for =: Let ac mod N = bc mod N. Then there exists a z € Z such that 
а-Ь= №є2. 
с 


Since c and N are coprime, we must have 2 € Z. Hence, (a — b) mod N = 0, and it 
follows from (D.2) that a mod N = b mod N. 


The equivalence (D.24) in Lemma D.7 suggests that there is something akin to a 
multiplicative inverse. This is indeed the case, and it is defined as follows. 


Definition D.8 Let b, N € N with gcd(b,N) = 1. The multiplicative inverse 
modulo N of b is denoted by b^! mod N and is defined as the number x € 


{1,...,N — 1} that satisfies 
bxmodN = 1. 
The multiplicative inverse is unique and can easily be determined with the 
extended EUCLID algorithm. 
Lemma D.9 Let b,N €N with gcd(b, N) = 1 and let x,y € Z be a solution of 
bx+Ny=1. (D.26) 
Then xmodN is the uniquely determined multiplicative inverse of b modulo 


N, that is, it satisfies 
(b(xmod N) modN = 1. (D.27) 


Proof We first show uniqueness. Let u and v be two multiplicative inverses for 
b modulo N, that is, suppose u,v Є (1,..., N — 1} are such that bumodN = 1 = 
bv mod N. Because of gcd(b, N) = 1 and (0.24), then bumod N = bv mod N implies 
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that u mod N — v mod N. From (D.2) we know that then N divides u — v. Because of 
0 « u,v « N, it thus follows that u — v. 

As to the existence, we can apply the extended EUCLID algorithm in Theo- 
rem D.4 to b and N and use that gcd(b, N) — 1 in (D.12) to find x and y satisfying 
(D.26). Then we have 

b(xmod N) mod N bxmodN — /(1— Ny) modN — 1, 
(D.20) (D.26) 


and since 0 < xmodN < N, it follows that xmod N satisfies all the defining properties 
of the multiplicative inverse of b modulo N. 


Example D.10 Consider the extended EUCLID algorithm in Example D.5 for the 
case b = 999 and N = 352. We see from Table D.2 that x = —105 and y = 
208 satisfy bx-- Ny — 1. Hence, x mod N — —105 mod 352 — 247, and we have 
b(xmodN) mod N = 999 x 247 mod 352 = 1, that is, 247 is the multiplicative inverse 
of 999 modulo 352. 


The following lemma is also helpful in the context of factorization. 


Lemma D.11 Any a,b,N € N with N > 1 satisfy 
abmodN —0 =  ged(a,N)gcd(b,N) > 1. 
In particular, if N is prime, then 
abmodN —0 <= amodN=OorbmodN=0 (D.28) 


holds. 


Proof Let ab mod N — 0. Then there exists a q € N such that ab — qN. From the 
prime decomposition of this equation 


= =b m ES 

—a =q =N 
ee ee ee 
MM coc 
Р Ps Pi Pr = рі Py Py Pu 


one sees that the prime factors of N have to be contained in those of a or b and 
thus that а or b must have common divisors with N, that is, gcd(a, N) > 1 or 
gcd(b, N) > 1. 
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If N is prime and N | аЬ holds, then N must be contained in a or b as a prime 
factor. Conversely, a mod N = 0 implies N |a and b mod N = 0 implies N | b. Either 
case has N | ab as a consequence. 


Definition D.12 The EULER function 6 is defined as 


0:N—N 


п э ф(п):= 


(0.29) 


{тє {1,...,п– 1} | ged(r,n) = 1} 


that is, ф(л) is the number of all r € N with 1 < r < n that have no common 
divisor (are coprime) with n. 


Example D.13 For n — 10 we have 
gcd(1, 10) = ged(3,10) = gcd(7,10) = gcd(9,10) = 1 
as well as 
gcd(2, 10), ged(4, 10), ged(5, 10), ged(6, 10), gcd(8, 10) > 1 


and thus ф(10) = 4. 


Generally, it is quite difficult to compute the EULER function. For prime powers, 
however, it is very easy as shown in the following lemma. 


Lemma D.14 For p prime and k € N one has 


ф(рЁ) = p* !(р- 1). (D.30) 


Proof In the set of the p* — 1 numbers 1,...,p* — 1 the р! — 1 multiples 
1p,2p,..., (p*-! — 1)p of p are the only numbers that have a non-trivial common 
divisor with р“. Consequently, the number $ ( p*) of those which do not have a com- 
mon divisor with p* is given by $(p*) = p — 1— (p! — 1) = p*-!(p— 1). 


For numbers N = pq that have only two simple prime factors p,q Є Pri, that is, 
so-called half-primes, the knowledge of ф (N) is equivalent to the knowledge of the 
prime factors p and q as the following lemma shows. 
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Lemma D.15 Let p and q be primes such that p > д and let М = pq. Then 
we have 


Ф(№) = (p- 1)(q- 1) 


and with 
S:=N+1-9(N) (D.31) 
DICEN (D.32) 
furthermore, 
pe A (D.33) 
а (0.34) 


Proof Since p and д are different primes, we find that among the N — 1 natural 
numbers smaller than N = pq only the numbers 1 x q,2 x q,...,(p—1) x q and 
1 x p,2x p,...,(q— 1) x p have a common divisor with N. Hence, we have 


$(N) 2N—1—(p—1)—(a—1) 2 pa— (pta) +1 = (р 1)(9— 1). 
Together with (D.31) and (D.32), this implies 


S=pt+q 
D=p-4q, 


and (D.33) as well as (D.34) follow immediately. 


Example D.16 In Example D.13 we found for N = 10 that $ (10) = 4. Using this in 
(D.31) and (D.32) yields 5 = 7 and D = 3, which in turn gives p = 5 and q = 2. 


The following theorem by EULER is useful for the decryption in the RSA pub- 
lic key encryption method as well as in connection with the prime factorization in 
Sect. 6.5.2. 


Theorem D.17 (EULER) Any coprime b,N € N satisfy 


p? тойм = 1. (D.35) 
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Proof First, we define a; :— rjb mod N for all r; € N with 1 < r; < N and 


gced(rj,N) = 1 and set 
(N) 
Р:= П aj | mod N. 


j=l 
From (D.21) follows that then 


(М) 
P = (ь?®?) [T rj) mod N. (D.36) 
j=l 


For j Æ k we have that a; 4 ар. To see this, suppose а; = ax, that is, rib mod N = 
ryb mod N. Since b and N are coprime, Lemma D.7 implies that then r; mod N = 
ry mod N. Because of the assumption 1 < rj, ry < N it follows that r; = т and thus 
j= К. Hence, а; 5 ак for j Z k. Since rj and N as well as b and N are coprime, it 
follows that also r;b and N are coprime, that is, 


ged(rjb,N) = 1. (D.37) 


Suppose a; = rjb mod N has a common divisor s > 1 with N such that a; = us and 
N = vs. Then there exists a k € Z such that us = rjb+ Куз, which is equivalent 
to rjb — (u — kv)s. This, however, would imply that rjb and N have a common 
divisor s > 1, which contradicts (D.37). Consequently, all a; are coprime with N 
and there exist @(N) distinct a; with 1 < a; < N. This means that the set of the a; 
is a permutation of the set of the r;, and thus 


$(N) 9(N) 
Р= П а; | mod N = Il rj | mod N, 
j=l j=l 
which, together with (D.36), yields 
O(N) O(N) 
(W) [T r;)modN = | [[ rj | moaw. (D.38) 
j=l j=l 
Since N and all r; are coprime, we can apply Lemma D.7 to (D.38) to obtain 


bÝ) mod N = 1, 


which was to be shown. 
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Example D.18 As we saw in Example D.13, one has for b — 7 and N — 10 that 
gcd(7,10) = 1 and ф(10) = 4. As stated in (D.35) we then find indeed 7^ mod 10 = 
2401 mod 10 = 1. 


As a corollary to Theorem D.17, we have what sometimes is called FERMAT'S Little 
Theorem. 


Corollary D.19 (FERMAT'S Little Theorem) Any b € N and prime p with 


the property p [b satisfy 
b?- mod p = 1. (D.39) 


Proof For a prime p one evidently has Q (p) = p— 1 and that p |b implies gcd(p, b) = 
1. Then (D.39) immediately follows from (D.35). 


Definition D.20 For a, N € N with gcd(a, №) = 1 we define the order of a 
modulo N as 


ordy(a) := min(m € N| а" mod N = 1}. 


If 
ordy(a) = o(N) , 


then a is called a primitive root modulo N. 


Example D.21 For N =3 x 5 = 15 we have ф(15) = 2 x 4 = 8, and with a = 7 we 
find gcd(7, 15) — 1 as well as 


m|12 34567 891011... 
7"mod15/7 4131741317 4 13... 


and thus ordj5(7) =4 < @(15). Whereas for N = 2 x 5 = 10 we find @(10) = 1x4— 
4, gcd(7, 10) = 1 as well as 


m1234567891011... 
7"mod10/793179317 oro 


that is, ordio(7) = 4 = @(10). Hence, 7 is a primitive root modulo 10. 
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The following results for orders and primitive roots will be of use for us further 
on. 


Theorem D.22 Let a,b, N € № with gcd(a, №) = 1 = gcd(b,N). Then the fol- 
lowing hold. 


(i) Forallk € N 
a'modN —1 =  ordyw(a)|k. (D.40) 


(ii) 
ordy(a) |@(N). (D.41) 


(iii) If ordy(a) and ordy(b) are coprime, then 
ordy (ab) = ordy (a) ordy (b) . (D.42) 


(iv) If a is a primitive root modulo М, that is, if it also satisfies ordy(a) = 
QN), then we also have 


(a) 
{d€ {1,...,.N—1}| ged(d, N) 2 1) = (a) modN| j € {1,...,0(N)}}. 
(D.4 
(b) If b — a! modN for a j € N, then 


$(N) 


ordy (b) = ordy (a/) = sed(j, 0 (5) 


(D.44) 


Proof Leta,b,N € N with gcd(a, №) = 1 = ged(b, №). We first show = in (D.40): 

Let k be a natural number satisfying a^ mod N = 1. Then k > ordy(a) has 
to hold since ordy(a) is per definition the smallest such number. Now, let c — 
k mod ordy(a), that is, c € No with c < ordy(a) and there is an / € Z such that 


k = ordy(a) l+ c and thus at = aimo) ee — (avo) a^. This implies 


1 = a'modN- (qme) а mod N 


— (qo mod) (а mod N) mod N 
(D.21) 


l 
= (ama mod N ) (a° mod N) mod N 
YY NN 
(D.22) =1 
= (а modN) mod N 


= а modN. 
Кр 
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Per construction, we have c « ordy(a), and since ordy(a) is per definition the small- 
est natural number k satisfying а mod N = 1, it follows that c has to vanish and thus 
ordy(a) |k. 

To show <= in (D.40), let ordy(a) |k. Hence, there is a natural number / such that 
k = ordy (a) l and thus 


l 
a'modN = (aeris) mod N 


П 
= (атна) mod N ) mod N = 1 mod N 
eue Se Ra 
(D.22) =1 


= d 


This completes the proof of (D.40). 

According to Theorem D.17, one has a9) mod N = 1, and thus (D.41) follows 
from (D.40). 

To show (D.42), consider first that 


(ab py rant a) ordy( b) mod N 


zc ordy(a) ordy(b ) mod N) (pori ) ordy(a) mod N) ) mod N 


ordy(b) 


= (© огам(а) mod N ) тоа N 


x (pit ) way") mod) mod N 
—— 
=1 
= 1тоаћ = 1 


and thus, because of (D.40), 
ordy (ab) | ordy (a) ordy (b) . (D.45) 
Analogously, it follows that 
q rdv (b) ordv(ab) mod N 


= (goo ordy(ab) mod) (print тойу) ordy(ab) modN 


=1 
(ab) we) ordy(ab) modN 


ordy(b) 
C mod N ) mod N 
——— 


= 1 (D.46) 
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and thus, due to (D.40), that 
ordy(a) | ordy(b) ordy (ab) . 
However, by assumption ordy(a) and ordy(b) are coprime, which implies 
ordy(a) | ordy (ab) . (D.47) 
Similarly, beginning in (D.46) with p?'dv(4)ordv(4^) mod N yields 
ordy(b) | ordy (ab) . (D.48) 


Again, as ordy(a) and ordy(b) are assumed coprime, it follows from (D.47) and 
(D.48) that 
ordy(a) ordy (b) | ordy(ab) . 


This, together with (D.45), yields (D.42). 
Suppose now a is a primitive root modulo N. To prove (D.43), we first show the 
inclusion 


{аі тойм | j € {1,...,0(N)}} C (d € {1,...N—1}| ged(d4,N) 2 1). (0.49) 


Then we will prove that the two sets have the same cardinality and thus are identical. 

To verify the inclusion, we show that the elements of (a! mod N | j€ 
{1,...,@(N)}} have the property ged(a/ mod N,N) = 1. To show this, suppose / € N 
is a common divisor of a/ mod N and N, that is, suppose that there are u,v € N 
satisfying 


аі mod N = lu 


N= ly. (D.50) 


Then it follows that Ju = af mod N = a/ — a N =a — Is lv and thus /|a/. 
Consequently, every prime factor of / would be a prime factor of a as well. Due 
to (D.50), such prime factors would then be divisors of a and N. But by assumption 
gcd(a, N) = 1. Hence, we must have / = 1, which implies gcd(a? mod N,N) = 1 and 
the inclusion (D.49) is proven. 

It remains to show that (a/ mod N | j € {1,...,0(N)}} contains indeed ф(№) 
distinct elements. Let i, j Є N be such that 1 < i < j < @(N) and suppose that 


a! mod = а‘ mod N. (D.51) 
With the assumption ged(a, N) = 1 it follows from (D.51) with Lemma D.7 that 


ali modN = 1, 
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which, together with 0 < j — i< $(N), contradicts the assumption that a is a 
primitive root, which means ordy(a) = @(N). Thus, the set {a mod N 
| JUL... 0(N) } contains exactly (N) distinct elements each of which is coprime 
to N. This completes the proof of the equality of the sets in (D.43). 
In (D.44) we first show that b = af mod N implies 
ordy(b) = ordy (a/) . (D.52) 

We have 

1 = Б) modN = (а? mod WN)? mod N 
(а)"%0) mod N, 


Кур 
(D.22) 


which implies ordy (a! ) < ordy(b). Conversely, it follows from 


ordy(a!) 


1 = (aiie) mod N — | (a/ mod N) mod N 
—— 


(D.22) 


— (b) ordy(a’) mod N 


that ordy(b) < ordy (a!) and thus (D.52). 
For the right side in (D.44) we know from (D.41) already that 


ordy (a/) |@(N), 
that is, there exists an m, € N such that 
my ordy (a^) = O(N). (D.53) 


Furthermore, | | 
l= (a! oria?) mod N = a9'dv(4)/ mod N 


implies, because of (D.40), that 
ordy(a) | ordy (а?) Ј. 
From the assumption ordy(a) = ф (№) follows the existence of an m» Є № such that 
т2ф(№) = ordy (a!) j. (D.54) 
Insertion of (D.53) in (D.54) yields 


m, |j. 
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Altogether, thus with (D.53) 


ordy (a! ) = nn ; 


and m, divides @(N) as well as j. That m; is the greatest such divisor can be seen 
as follows. Suppose that 


mı < M :— gcd(j, 0 (N)). 


Then we would have for 


that 


AT 900) i 
(ai) modN = (a!) ^ modN = (a9) " mod N 


Ai 
= (gt? modN) " modN = 1. 
— ——„—— 
(D.22) =1 


This contradicts the fact that ordy (a! ) is, by definition, the smallest natural number 
with the property (a/)” mod N = 1. Consequently, we must have m; = gcd( j, ф (N)), 
and (D.44) is proven. 


Before we give the proof of the existence of a primitive root for primes, we show 
two lemmas, which we use in that proof. 


Lemma D.23 Let p be a prime, k € No and (f;| j € {0,...,k}} C Z with 
p [fx and let f be the polynomial 
f:Z—Z 


k З 
ЕУ 
j=0 


Then either 


(i) f has at most k distinct zeros modulo p in (1,...,p — 1) CN, that is, in 
{1,...,p—1} there are no more than k distinct natural numbers nj that 
satisfy 

f(nj) mod p — 0, 
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or 
(ii) f is the zero-polynomial modulo p, that is, 


f(x)modp=0 Vx€Z. 


Proof We show this by induction in the degree of the polynomial, which we start at 
k= 0: if f(x) = fo 40 such that p /' fo, then it follows that fọ mod p 5 0, and there 
is no x € Z with f(x) mod p = 0. If fo = 0, then f is the zero-polynomial. 

The inductive step is performed from k — 1 to k. Suppose then the claim holds 
for all polynomials of degree up to k — 1 and f is a polynomial of degree К. If f has 
fewer than k zeros modulo p in (1,...,p — 1}, the claim holds already. Otherwise, 
let n1,...,ny be k arbitrarily selected zeros of f modulo p from the set (1,..., p — 1}. 
Then 


k с 
g(x) := f(x) — fx I-n) = у вх! (0.55) 
j=l 1-0 
is a polynomial of degree not exceeding К— 1. 
Furthermore, every of the k selected zeros n; € (ni,...,n,) satisfies 
k 
g(nj) mod p = кы) mod p= f(n)modp=0. (р.56) 


Set т :— max (1 € {0,...,k— 1} | р/в) and 
m 

= у е. (D.57) 
0 


Since then p | g; for all / > т, we have for all x € Z that 


m k-1 
(х) mod p. = (5 gix j mod p — (= ear) modp. = g(x)modp, (D.58) 
(D. mel 1=0 1=0 (0.55) 


and the set of zeros modulo p of g апа g coincide. Because of this and (0.56), & 
has at least k zeros modulo p. At the same time g is a polynomial of degree not 
exceeding k — 1 and thus satisfies the inductive assumption, which then implies that 
8 and, because of (D.58), also g can only be the zero-polynomial modulo p: 


g(x)modp=0 VxcZ. 


With (D.55) it thus follows that for all x € Z 
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k 
f(x) mod p — fk [ [(x— nj) mod p, 
j=l 
and for an arbitrary zero z of f modulo p we have 
k 
0— f(z) mod p = %[](@—п;) mod p. 
j=l 
Since by assumption p ffx, one of the factors in IT. (z— nj) has to satisfy 
(z—nj) mod p = 0. 


As we chose the n; form the set (1,..., p — 1), it follows that z mod p = nj, and z is 
either one of the k zeros selected from (1,..., p — 1} or it differs from one of these 
by a multiple of p and is thus not an element of the set (1,...,p — 1]. 


Lemma D.24 Let p be prime, d a natural number satisfying d | p — 1 and let 
h be the polynomial 
h:Z—Z 
== Aix) с=з = 1. 


Then there are d zeros of h modulo p in (1,...,p — 1) C N, that is, in 
{1,...,p—1} there exist d natural numbers nj satisfying 


h(nj) mod p — 0. 


Proof Let k € N be such that p — 1 — dk and set 


k-1 


1 
Р(х) := 2. (^) ' 
Then we have 
k—1 1 Е 
g(x) := h(x) f(x) = (x4 — 1) 2. (x) = xP-!_1, 


Since p — 1 = ф(р) and, according to the EULER Theorem D.17, a? mod p = 1 
for alla € (1,...,p— 1}, it follows that for all z € (1,...,p— 1} 


p-1 


z modp=1. 
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Hence, all p — 1 = dk integers in {1,..., p — 1} are zeros modulo p of the polynomial 
g. Since p is a prime and g = hf, each of the dk zeros nj € (1,..., p — 1} of g modulo 
p has to satisfy 

h(nj)modp=0 ог f(nj)modp=0. 


According to Lemma D.23 the polynomial h has at most d and the polynomial f has 
at most d(k — 1) zeros modulo p in (1,...,p — 1}. Denoting the number of zeros 
modulo p in {1,...,р — 1} of the polynomials g, and f by N,, №, and Ny, we have 
thus 

dk = Ng € Ny +Nf € d - d(k— 1) = dk. 


This can only be true if f has exactly d(k — 1) and Л has exactly d zeros, which was 
to be shown. 


Theorem D.25 For every odd prime p there exists at least one primitive root 
a modulo p, that is, a natural number a such that 


ога, (a) = ф(р). 


Proof Let q be a prime factor of p — 1, that is, there exists a kq € N such that q^|p— 


1. From Lemma D.24 we know that the polynomial h(x) := xf — 1 has exactly д 
zeros modulo p in (1,..., p — 1}. Let a; be one of these zeros such that it satisfies 


Cu — 1) mod p = 0 
and thus 
kq 
айд modp=1. 


Since a, € {1,...,p— 1} and gcd(a;, p) = 1, it follows from (D.40) in Theo- 
rem D.22 that 
ога (aq) |^. 


If this zero a, of h has the additional property ога, (ад) |q} for a j € N with j < 
kq, then ord, (aq) |q'* ! holds. This means that there is an n € N with q^! 
ord, (a) n and thus according to (D.40) in Theorem D.22 


pM 
q 
af 


1 
4 modp-l. 


Hence, a, € (1,...,p — 1} is a zero modulo p of the polynomial f(x) := xi 1. 


According to Lemma D.24, there are exactly q%17! of these. Of the q*« zeros modulo 
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pin{1,...,p—1} of hat most q*«^! can be zeros of f as well. This means that of the 
q^ zeros a, of h at most 447! such a, exist that also satisfy in addition ord, (ag) | q/ 
with j < kq. Consequently, there remain фе — 44! zeros a, € {1,...,p — 1} that 
satisfy 


ога, (ал) |q" and ога, (ал) fq! Vj < kq- (D.59) 

Since q is assumed prime, it follows for the g — q*«^! numbers аа that sat- 
isfy (D.59) that 

q^ = ord,(aq) . (D.60) 
Now, let 

p-1- П 4“ 
q€Pri(p-1) 

be the prime factorization of p — 1 and 

asm p а. (D.61) 

qc€Pri(p-1) 


For arbitrary q1,q2 € Pri(p — 1) with д 4 д2 we have 
d(ord d = ged(g ,q2) = 1 
gc (or p(dq,) , or plaq )) = gc (qi KD у= E 
This, together with (D.42) in Theorem D.22, implies 
ka, k 
ord, (ада) = ordy (aq, ) rdp (aq) = 4ү q^ (D.62) 


and thus, finally, 


ord,(a) = “( Il «) = ord, (ay) 
(D.61) qePri(p-1) (D.62) 4€Pri(p- 1) 
= ач 
(D.60) 4€Pri(p- 1) 
= 6(p) 
(D.30) 


This shows that every odd prime p has a primitive root modulo p. To show that 
also every power of an odd prime has a primitive root, we still need the following 
lemma. 
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Lemma D.26 Suppose an odd prime p and a primitive root a modulo p sat- 
isfy 
aP) mod p? #1. (D.63) 


Then one has for all k € N 


a?) mod p! 4 1. (D.64) 


Proof From Theorem D.17 we have for all k € N that 

ao?) mod p* = 1, 
that is, for every k Є N there exists an n, € N such that 

a9 0 — 1 + пер“ (0.65) 
holds. We prove the claim (0.64) by induction in k. The start of the induction for k = 
1 is given by (D.63). For the inductive step from k to k+ 1 we suppose that (D.64) 
holds for k such that for all m € N we have 

o(p*) #1+mp!, (D.66) 
From (D.66) it follows for n; іп (0.65) that p }[лк. According to Lemma D.14, 

o(p!) = р — pl = p(p* — р!) = po(p") 

holds and thus 


аё!) — ае) = (a9)? 


Жау (+p) = Y Ө (n.o) 
(D.65) 


i=0 
E Lente Y (у ) пір“, 


where in the last equation the binomial coefficient for / = 1 contributed a factor р. 


This implies 
oo!) _1 
Е = з 1 ,k(I-1)-2 
p oy Hm ILE 
da 


ee 
eZ EN 
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and thus the claim for k + 1: 


a9 mod p? 4 1. 


Lastly, we show that every power of an odd prime has a primitive root. 


Theorem D.27 Let p be an odd prime and let a be a primitive root modulo 
p. Then for all k € N either 


ord, (a) = o(p*) (D.67) 


ord (a-- p) = (p), 


that is, either a or a+ p is a primitive root modulo p*. 


Proof We distinguish between two cases. 


Case 1: 
a9 P mod p? 7 1. (D.68) 


Case 2: 
a9 P mod p? = 1. 


Consider first case 1. We show by induction in k that in this case (D.67) holds. The 
induction-start for k — 1 is given by the assumption that a is a primitive root modulo 
p. For the inductive step from k to k+ 1 we suppose that (D.67) holds for К. Per 
definition D.20 of the order, we have 


ord a 
a S ) mod р“! = 1, 


that is, there exists an n € N such that 
ape) _ 1-+пр =14npp*. 
Then (D.40) in Theorem D.22 implies 
ord к(а) | ord x+ (а). 


By the inductive assumption, ord к(а) = 6(p*) = р“! (p — 1) holds and thus 


p'(p—1)| orde (а). (D.69) 
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Theorem D.22 also implies 

ord x+1(a) |6(p**") = p'(p— 1). (D.70) 
From (0.69) and (D.70) it follows that there exist a nı,n2 € N such that 


mp !(p— 1) = ord cci (a) 
ord + (a) m = p'(p— 1), 


which implies n1n5p'-!(p — 1) = p*(p — 1) and thus nım = p. Since p is prime, 
we can only have either 


nj =1 and m=p (D.71) 
Or 
n; =p and mn; = 1. (D.72) 
But the case (0.71) would imply ord к(а) = p (p—1), = 6(p*) as a conse- 
(D.30) 
quence and thus 
abl”) mod p*+! = 1. 


This, however, is impossible because of the case assumption (D.68) and its impli- 
cations in Lemma D.26. On the other hand, the case (D.72) implies ord e+ (a) = 


p'(p —1) = 6(p**"), which is the claim (D.67) for k+ 1. 
Now, let us consider case 2 and suppose 


a9 P mod p? = 1. (D.73) 


We show first that in this case a+ p is a primitive root modulo p and then that it 
satisfies the conditions of case 1. Setting r :— ога, (a + p), it follows that 


г< ф(р) (D.74) 


and per definition 
(a+ р) modp = 1. 


The latter means that there exists a natural number m such that 


EE 
у ME 1+mp. 


1=0 
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This in turn leads to 


——— 
EN 
and thus 
a’ modp— 1. 
Hence, we must have 
r > ordp(a) = ф(р). (D.75) 


From (D.74), the definition of r and (D.75) it follows that 


ord,(a+ p) = ф(р), 


that is, a 4- p is also (besides a) a primitive root modulo p. From (D.73) it follows 
that there exists an пз Є N such that a?~! = 1 + n3p?. Hence, there also exists ап 
n4 € N such that 


p-1 —1 
(ap)! = s e p- Qe?» Y (^, Jarry 
1-2 


p-1 


—1 
1 E nap? + pa? — ра + У, (’ art! 


1=2 І 


(0.73) 
= cnp — ра? 2. (0.76) 


The assumption а! mod p = 1 implies р/а? 2. Hence, it follows from (D.76) that 
(a-- р)?! mod p? #1, 


implying that a 4- p is a primitive root modulo p that satisfies the condition (D.68) 
of case 1. As shown in that case, it is then a primitive root modulo p* for all k € N. 


Finally, we prove one more result, which we need in the context of SHOR’s fac- 
torization algorithm. To estimate the probability that in this algorithm the selection 
of b does not satisfy the criteria in (6.25), we need the following result. 
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Theorem D.28 Let N — Wain; with nj € N and ged(nj,nj) = 1 if iF j. 
Then there is a bijection between the set 


A:= {a€ (1,...,N — 1) | ged(a,N) =1} 
and the set 
= {(bi,...,b,)|Vj b; € {1,...,nj – 1} and ged(bj,nj) = 1). 
This bijection g : A — B is defined by 


g(a) := (amodn,,...,amodny) =: (g(a)1,.--,g(a)s)- 


Proof We show first that g{A} C B. By definition, we have g(a); € {1,...,n;— 1}. 
We show that gcd(g(a) j,n;) = 1 holds for a € A. Suppose y is a common divisor of 


ue and n;. Then there exist /,k Є N such that yl = g(a); =a— BH yk and thus 


PESE k € N, that is, y divides a, and since y per definition also divides пу, 
nj 


i divides N as well. Hence, y is a common divisor of a and N, which, because of 
а € A and the definition of A, implies y = 1. This completes the proof of g{A} C B. 

Next, we show that g is injective. Let а, а € A and suppose a; > a» and g(a) = 
(a2). Then it follows for all j € (1,...,J) that 


a; modn; = a? modn; 


-5-(- 


Consequently, every n; divides a; — az € No, and since gcd(nj,n;) = 1 for iF j, it 
follows that then also N — II nj has to be a divisor of aj — a? > 0. This means 
that there is a k € No with ` 


and thus 


ај = а +kN. 


Since ау,а2 € A C {1,...,N — 1} we must have К = 0 and a; = a», implying that g 
is injective. 

Lastly, we define an ^ : B — A and SHOW that goh = idg. For b := (b1,...,b;j) € B 
we define (b) as follows. Let m; :— =. We then have ged(m;,n;) = 1, and because 
of (D.12) in Theorem D.4, there cdit: xj € Z such that mx; 4- njy; = 1. With the 
m; we define 
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J 
h(b) := РО) mod N. (D.77) 
j=l 


We proceed to show that Л is well defined despite the non-uniqueness of the ху, уу. 
For this suppose that x;, 5; Є Z, such that also m;X;-+nj¥; = 1. Then it follows that 
forallk=1,...,J 


л я т) 1—тпкук—(1—пкЎ 
Fi РОЛ) = > (xj — £j)bj 4- : ) p, Z, 
BE, £ 
eZ 
(D.78) 


that is, every n, divides Уу mjxjb; — тууру for all k € {1,...,J}. Since 
ged(nj,ni) = 1 if i Z j, thus N= Wein j also divides this difference, and there 
exists az € Z with 

7 J 

у mjxjb; = у mjXjb; +2N, 


j=l j=l 


which implies 


J J 
j=l j=l 


This shows that the right side in (D.77) is independent of the choice of the ху, and 
h(b) is well defined for all b € B. 
We now show that h{B} C A. Similar to (D.78), one has for all b € B and k € 


1,...,J that 
: (h(b) — by) : bj; | modN—b 
— — = — у тухуЬ) — 
nk 5 Nk j=l УУ i 


т; myxy — 1 x. mjxjbj | N 
=- У J xib;-- e b EI Z, 


J 


єй єй 


that is, for every k € {1,...,J} there is ал € Z with 


h(b) = Б + спр. (0.79) 
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Therefore, every common divisor v of h(b) and n, is also a common divisor of bg 
and ng. Because of b Є B, it follows that we must have v = 1 and thus 


gcd(h(b),m) = 1. 


Furthermore, according to Definition (D.77), then h(b) € 10,1,..., N — 1}. The case 
h(b) — 0 can be excluded, since, if there were a z € Z with XL mjxjbj = zN, we 
would have for every k € {1,...,/} that 


l-n my xy b, N т; 
Юк = кк _ У j 


nk nk Mk тд Mk 


Hence, л would be a divisor of Бу, which, however, is excluded for b € B. Conse- 
quently, ^(b) € (1,...,N — 1) with gcd(h(b),n;) = 1 for all j and thus h(b) € A. 
It also follows from (0.79) and by < n, that 


g(h(b)), = g(bk + zung) = (by + сет) mod ny, = dy. 


This shows that g o h = idg, proving that g is also surjective and altogether thus 
bijective. 


Appendix E 
Continued Fractions 


Definition E.1 Let ао be an integer, and let (a1,...,a,) be a finite sequence 
of natural numbers. The number denoted by [a0;a1,...,a;] and defined as 


[a0:41; . .., a5] :— a0 1 (E.1) 


ирке Б, 
ап—1+ aq 


is called a (regular) finite continued fraction generated by (ao, ...,a;). 
For any j € {0,...,} the number 


1 
405;01,...,0j| = a9 + ———_— 
[ ? ? jl m m 1 
ү 2j-1td; 
is called the jth convergent of the continued fraction [ao;a1,...,a;]. For any 
sequence (aj) „гу the sequence (|ao:a1,...,aj]) jc, is called the sequence 


of convergents. 


Continued fractions can be defined more generally by replacing every 1 in (E.1) 
by elements b; of a sequence (bj) of integers. These would no longer be called 
'regular' continued fractions. Since for our purposes we will deal only with the 
regular continued fractions defined in Definition (E.1), we shall omit the adjective 
‘regular’ henceforth. 
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It can be shown that, as the name suggests, the sequence of convergents always 
converges to a limit 


[a0:41,...] := lim [ao;44,...,a,] = lim | ag4- (E.2) 


n—oo поо 


This is why in the literature a continued fraction is often introduced ‘as an expres- 
sion of the form’ 


[ao;a1,...] = ao + 


0,1 
Maj —— 


Moreover, it can be shown that any real number may be expressed as a limit of 
a suitable sequence of convergents. We will not prove this and the convergence 
claimed in (E.2) here since it is not required for our purposes. The interested reader 
can consult the classic treatise by HARDY and WRIGHT [90] or can attempt the 
proof with the help of Corollary E.8 below from which it is only a small step to 
establish the ‘convergence of the convergents' claimed in (E.2). 

However, in the following we show how for a given real number a suitable 
sequence of convergents can be constructed. 


Lemma E.2 For every x € R define sequences (fj) and (aj) as follows. 


Ifx=0, then the sequence (fj) is empty and the sequence (aj) consists 
only of (ag = 0). 
Ifx #0, then set 


jin 2m - ЄК and ag:— ЕЭ =|х|є2 (Е.3) 


and for j € N 
if fi-1 90. then 


57 Є[0,1[ апа а= Iz EN; (E4) 
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if fj-1 =0, then the sequences (f;) and (aj) are finite and (fj) termi- 
nates with the last element given by fj. = 0, whereas (aj) terminates 
with the last element а}—2. 


Then we have 


х= ao- fi = a+ 1 7 (E.5) 
С сз 


* 1 
anth 


where the last equation holds for every n € N for which ў, is defined by the 
construction rules for ( f;). 


Proof Note that for the sequences (fj) and (aj) defined by an x < 0, only ao and fo 
are negative. For those fj and a; that are defined, we have, per definition given in 


(E.4), 
1 1 1 
pm —|—|>0 and ар=|—|>0. 
fi fia PUE mo BE 


From (E.4) it follows that for any j € N for which fj+ı is defined, we have 


1 
p= (E.6) 
^ aj+fj 
In particular, we have 
1 1 
ат fo — Й 
хм a + fi 
(E3)  (E6 
which implies 
х= ao fi (E.7) 


Moreover, we can iterate (Е.б) for all j and n such that j < n and ў, exists to 
obtain 


1 1 1 


f= _ ie (E.8) 
(E.6) ajt fa &o ^ "CHEERS 


"ed. ad e. 
"atf 


Inserting (E.8) for j — 1 into (E.7) yields the claim (E.5). 


The sequence (aj) constructed in Lemma E.2 can then be used to build a sequence 
of convergents as defined in Definition E.1. 
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Example E.3 The sequence of convergents constructed with (a;) from Lemma E.2 
also approximates irrational numbers x relatively quickly. For example, the 6-th 
convergent of J 2 satisfies 


V2 = [1;2,2,2,2,2,2,..]= [1;2,2,2,2,2,2] + 1.23789... x 10 95. 


Theorem E.4 For an x € R the sequence (aj) constructed as in Lemma E.2 
terminates if and only if x is rational, that is, we have 


х= [ао;а1‚...,а| = xEQ. 


Proof =: Let 
1 
x = [a0341,.-.,4n] = ao + ———— (E.9) 
a a+ 
e 
and for j € (n,n — 1,...,0] define successively 
Pn := а and qn:= 1 forj=n 
BIST ec a TOM and qj-1 := Pj for j € {n—1,...,0}. 
dj-1 Pj 


Then we have for j € {n,...,0} that p;,q; € Z. Moreover, it follows that 


ix à; 1D;ctd; 1 1 
Pj i j-1Pj Wig 45 =ajit 
dii Pi | T aj+ 
J $ 
such that finally 
ро 
Q2 = ай + =: xs 
qo a+ Eo 


<=: Now, let x = 5 € Q. The case х = 0 is trivial. For x Æ 0 let (fj) and (aj) be the 
1 


sequences defined in Lemma E.2 starting with fo = 5. Define a sequence (rj) by 
rj: p€Z«(0) and ro:-q€ N and 


E.10 
гу = rj.jmodr; for j € № such that r; 40. ( ) 


Appendix E: Continued Fractions 549 


Then we have 


ro 
fy=-=t=7cQ, (E.11) 
P г 
and we show by induction that for j € No 
5 
fj2-—-eQ. (E.12) 
rj-1 


The induction-start is given by (E.11). For the inductive step from j to j 4- 1 suppose 
(E.12) is satisfied for a j € No. It follows that 


i = 1 А rj-l Е E rj.jmodr; B JH. (E.13) 


e Fi ar ES r; | ri YY r 
(E.4) Л uj (gi 7 J - (pi) d (gi) 7 


proving (E.12) for j+ 1. Since 0 € rj, = rj; тойгу < r; holds, the sequence (r;) 
constitutes a strictly decreasing sequence of non-negative integers. This implies that 
after a finite number of steps we must find r,,, = 0 for some n € No. It follows 
from (E.12) that ў, т = 0, which means that the sequence (a i) ends with a, and 
(E.5) implies that x = [ao;a1, ... , a5] holds. 


Note that the sequence (rj) defined in (E.10) is similar to the one used in the 
extended EUCLID algorithm in Theorem D.4. Consequently, the number п of the 
aj that have to be calculated for the continued fraction representation of a rational 
number satisfies the same bound. 


Corollary E.5 Let p,q € N be given and let 


[а0;а1,...,а,] = (E.14) 


P 
q 
be the finite continued fraction representation of the rational number E Then 
we have 

n < 2min(log, q,log, p) -- 1. 


Proof Let (f;) be constructed from x = Ë as in Lemma E.2. This sequence termi- 
nates as soon as f; = 0 for the first time. From (E.12) we see that f; = 0 is equivalent 
to rj = 0, where the sequence (rj) is defined as in (E.10) and satisfies the recursion 


rj —rj-a modrj—1 А 


which is similar to (D.5) in the EUCLID algorithm in Theorem D.4. With the help 
of (D.3) from Exercise D.119 and just as in (D.16) it follows that 
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. [l'j-2 
rj «min(77 ja 


We can thus apply the very same arguments as after (D.16). Since, due to (E.14), n 
is the largest number for which r, > 0 holds, we infer from (D.17) that 


n < 2min(log, q,log; p}+ 1. 


Example E.6 As an example for a continued fraction expansion of a rational num- 


ber we have 67 à 
— = [1;2,2,1,6] = 1 + ———__ 
ai | | TA 4 


Theorem E.7 Let I = {0,...,n} © No or I = No, and let (aj) е, be a 
sequence of numbers, where ag € Z and a; € N for j 2 1. Then the continued 
fractions constructed with (aj) „у satisfy: 


(i) For all j € I there exist ру € Z and qj € N such that 


аа (E.15) 
4j 


(ü) The p; and q; in (E.15) can be obtained by setting 
p2=0=q-1 and g2=1=p-1 (E.16) 
and for j € I by defining them through the recursion 


ee ee 
Pj jPj-1-- Pj-2 (Е.17) 
qj = 4343-17 dj-2; 


that is, the p; and qj defined Бу (E.16) and (E.17) satisfy (Е. 15). 


(iii) The sequence (q 3), c, has only positive elements and growths faster than 
the FIBONACCI sequence given by Бу =0,b; = 1, (bj —bjc В) 2 


In case ао > 1, the same holds for every element in the sequence (pj) jer 


Proof The claim in (i) follows immediately from Theorem E.4 since the continued 
fraction expansions [а0;а1,...,а;| are finite. 
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We prove (ii) by induction. Let the p; and q; be as defined in (E.16) and (E.17). 
For the induction-start we show (E.15) for j € {0,1} by using (E.16) and (E.17) as 


follows: 
= app-ı +p2 = а 0 
poaniet] = әтәс 
i 1 (E.18) 
d M } = Pl Z ag + — = [ao;a1] 
qı = 4190 79-1 = а] qi а 
For the inductive step from j to j+ 1 suppose that fora j € I 
р} 
22 = [а0;а1,...,ај (Е.19) 
dj 
holds. Define the function g; : Qx {0} — Q by 
mpj-i- pj-2 
gj(m) :— a ас (E.20) 
mq j—1 7 Gj-2 
which satisfies 
ajpji-cPj-2 _ Pj l 
gjlaj) = = = |ao;a1,...,aj] = ao + 
Ww ata м qg; NA “WY NEN 
go 74771 ' 4j-2 (кү) 4/ (кто) (E.1) дй | 
such that 
(m) + : (E21) 
(т) = ао : 
MN e var 
(E.20) Ep Ld 
vos 
From this it follows that 
А ПЕЕ EI a 
Dj c agipjtpja Р) aj Pj! _ (a; ZL) pia Pj-2 
пр ММ angit; о 2а 1 
dj (E.17) 4pAdjtdji t aati- ү, (а;+ zai tai 
CUT a 
= gj а; = ао 
we I а m 1 
(E.20) (E21) , | 
ај+ ат 
=, [a0341,---,4j-1,4j,4j+1] 
(E.1) 


and the inductive step from j to j+ 1 is verified. 
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To show (iii), note that we have from (E.16) that qo — 1 and from (E.18) that 
qı = aj as well as by construction that a; € N for j > 1. Using this and (E.17), it 
follows immediately that q; = а;9;1 + dj-2 > 9j-1 +4j-2. In case an a; is greater 
than 1, then q; is strictly greater than the j-th element of the FIBONACCI sequence, 
and this then also holds for all following elements. Similarly, if ао > 1, we have 
that po = ао 2 1, pi = ада + 1 > 1 and with (E.17) that pj = ajpj-1 + pj-2 2 
pjacpj-a. О 
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Proof To prove (i), note that for j € ГУ {0} we have 


£j = Djdj-1-—djPj-1 


=, (ajpj-1 + pj-2)djA — (ajqj-1-- 9j-2) Pj-1 


m 
- 
= 
I 


Pj-24j-1 — qj-2Pj-1 = —Zj pore = (“= 
(1) 1а = (21)! (piqo — aipo) 
(—1)/-! ((a1ao + 1) — aja) 


which proves (E.22). This in turn implies (E.23) as follows. Suppose 


qj—djgcd(gjp;j) and pj = pjgcd(qj,pj)- 
With (E.22) it follows that 


Z (-1)/ 
э рудј+ 4р = —————‚, 
PTUS TU ged(qj, Pj) 
which requires gcd(q;, ру) = 1, that is, (E.23). 
To show (ii), we note that fork € I 


Pk Pk+t _ PkOk+1—~ крк — oy (E.28) 


Як Чк+1 4к9к+1 “У” QkQk4el 
(Е.22) 


and thus for any j € J such that j >К 


Pe Pj _ Pk Phu, Pei Ри, PP Pj 
dk dij dk — dkx1 9+1 — dk42 43-1 dj 
Е (—1)**! | (—1)+2 ТП (—1)/ 

im dkdkl 9+19к+2 qj-1dj 

dj-k-d —]y 
- Gay (-1) 


proving (E.24). 
To prove (iii), we observe that 
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P2k 2k+2 1 1 
Рк _Р2+2 __ cae ) 


qok  qoko2 бы G2k+292k+1 920+-192к 


1 ( 1 1 ) 
= <0, 
qok-l NQ2k-2 2k 
— aM 


М 
<0 


where we used (iii) in Theorem E.7 to ascertain qo», < 422. This verifies (E.25). 
Similarly, one shows (E.26). 

In (iv) the inequalities for even indices follow from (E.25) and those for odd 
indices from (E.26). To prove (E.27), it remains to show that for an arbitrary k € I 
the quotient for 2k is smaller than that for 2k + 1. From (iii) in Theorem E.7 follows 
that q2kq2k+1 > О for arbitrary k € I. With this we obtain the desired inequality as 
follows 


a 2 — 1 
P2k+1 P2k _ P2k+192k — P2k92k+1 a > 0. 


d 3 SY’ 
G2k+1 42k 2k 42k+1 (E22) 92k 92k+1 


With these auxiliary results we can now show the claim required for the SHOR 
algorithm, which states that, if a positive rational number is sufficiently close to 
a second positive rational number, the first rational number has to be a continued 
fraction of the second. 


Theorem E.9 Let P,Q € № be given and let |ao;...,an| be the continued frac- 
tion of their quotient, that is 


[GO GERE = 0 (E.29) 
If p,q € N are such that 
P p 1 
_—=—|<—— Е. 
Q A 2g” с 


then г is a convergent of the continued fraction of e that is, there exists a 
j € (0, 1,..., n] such that 
Pj 


= О aod] = Ge 


Q's 


where p; and q; are as constructed in Theorem E.7. 
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Proof Let po,...,ps and qo,...,q, be given by the recursive construction rules 
(E.16) and (E.17) in Theorem E.7. This implies that for j € (0,...,n] we have 
[ао;а1,...,ау| = _ 2 and, in particular, 
Pn P 
— = [ao;a1,.... an], =, 5 (E.31) 
ме 
Яп (E29) Q 


First, suppose q > qn. Then we have 


Pn P 
Qn q 


Кр 
(E31) (E.30) 


and multiplying both sides by qqn yields 


zd 
[Pnd — da | <2 = 


Since Png — qup Є Z, we must have png = qnp, which implies ^ P= , and the claim 
holds with j — n. 

Now, suppose q < qn. From (E.18) we know that qo = 1. Therefore, in the case 
q < qn there must be a j € (0,...,n — 1} such that 


— Pn 
~ Qn 


4) 9 <4}+1. (Е.32) 
We show that then the following inequality 


1 
ЫРУ 


Pn Pj 
Qn Qj 


= dj 


(E. Б) 


holds. For this we choose a,b € Z as follows 


a= =] Ј+1 x pes 5 
( ИК (aj iP Pj+19) (E33) 
b—(-1)" (pja—ajp). 
This implies 
pjat pj+ıb = (—1)/! (PjdjAP — PjPj+19+ Pj3APjd — Р}+\Чур) 
= (—1)/ (руні — Pj+14;) P (Е.34) 
SS 


= (cp 


] 
© 
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Similarly, one shows that 
qja qj41b = 4. (E.35) 


From (E.23) in Corollary E.8 we know that 


gcd(qj+1,pPj+i) = 1. (E.36) 
This excludes a = О, for, if a = 0, it would follow from assumption (E.32) and (E.33) 
that pj+1 = a p > p and thus 
PH P 
4ј+1 а 


with рут > p and qj4.1 > q, which is impossible because of (E.36). Hence, due to 
a € Z it must be that |a| > 1 and we obtain 


p p 
m —р| = |(aqj + baj-1) — – (ар, +bpj+1)| 
Яп Яп 
= |а GA -»;) +b (Ж -рт) | Я (E.37) 
Gn Яп 
=:Сј =С}+1 


According to (E.27) in Corollary E.8 one has for even j € {0,...,n— 1} that 


Pi < Pn < PHA 


qj Яп qj4l 


, 


whereas for odd 


This implies 
CjC 4-1 < 0. (Е.38) 


On the other hand, it follows from (E.34) that 


Pt PIS 
Pj 


b 


such that 
а<0 => b»0. (E.39) 
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Similarly, it follows from (E.35) that 


q—qj+ıb 
а= =— 
qj 


and with b € Z as well as q < qj+1, thus, 
b>0 => q<baqj4 => a<0. 
From (E.39) and (E.40) follows ab < 0 and together with (E.38) that 


(acj)(bcj+1) 2.0 


557 


(E.40) 


(E.41) 


With this we can estimate a lower bound for the left side of (E.37) as follows: 


Pn 
q— -p| = jacj+bejri| = ‚|ас]| + |Бс}+1 
W% -+| = JS lacs + [bej 
(E.41) 
Pn 
> |асу| = |41; > |с = |4: -pj 
dn 
which leads to 
P pj 22l саар : 5-5. iz -z 
О 41—19 9 1—93 19 91—910 9\24; 292  24qjq 
(Е.31) (E.42) (E31) (E.30) 


Combining (E.30) and (E.43) we then obtain 


2-2 = 2-55-20 
а dj а О Q qj 
P| |Р p; 
f jc Dj 
а О Q qj 

i 

202 24; 


(Е.30),(Е.43) 


Multiplying both sides in (E.44) with gq; yields 


1 


|рау—ар}| < © +} < 1, 
2g. 2м 
(Е.32) 


that is, | pq; — ар) < 1, which, because of pq; — qp; € Z, finally implies 


P Pi 


q qj 


(E.42) 


(E.43) 


(E.44) 


Appendix Е 
Some Group Theory 


ЕЛ Groups, Subgroups and Quotient Groups 


Groups play a very important—if not crucial—role in physics in general and in 
quantum mechanics in particular. They are formally defined as follows. 


Definition Е1 A group (9,-) is a set 9 together with a binary operation 


28 Gx 9 —5 9 
(g,h) — g-h=: gh 


called (group) multiplication that has the following three properties. 


Associativity: the group multiplication is associative, that is, for all g,h,k € 
© 
(g:h)-k— g- (h- K) (Е.1) 


such that g-h-k is well defined since it does not make any difference which 
of the two multiplications is carried out first. 
Existence of a unit or neutral element: there exists an e € 9 such that for 
every g € 9 
део. (F.2) 


Existence of inverses: for each g € G there exists an element g^! € G called 
the inverse of g which has the property 
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ag =e (ЕЗ) 


A group 9 is called discrete if the set € is countable. The group is called 
finite if the set 9 is finite. The number of elements in a finite group is called 
the order of the group and denoted by |91. 

If for g € G there exists an n € N such that g” = e, then the smallest such 
n is called the order of the element g and denoted by ord(g). If no such n 
exists, the order is said to be infinite. 

A group is called abelian if the order of the multiplication does not matter, 
that is, if g-h = h- g forall g,h € 9. 


To emphasize which group multiplication is used, we write at times -¢. On the 
other hand, if there is no danger of confusion, the multiplication sign - is often 
omitted and one writes 9 instead of (9, ·) and gh instead of g-h. For abelian groups 
the multiplication is often denoted by + instead of -. 

It turns out that the unit element of any group and the inverse of any group ele- 
ment are unique. 


Exercise F.121 Show that the unit element of a group 9 is unique and that for any 
g € 9 its inverse g^! is also unique. 


For a solution see Solution F.121 


Hence, we may speak of the neutral element of a group and, likewise, of the inverse 
of a group element. 


Exercise F.122 Let S be a group with unit element e. Show that then 


el-e (F.4) 
and for all g,h € 9 
(8h)! = h'g! (Е.5) 
_1у—1 
ie) =g (Е.6) 
8 пыр, (ЕЛ) 


where we have already adopted the convention of not writing out the group multi- 
plication sign -. 


For a solution see Solution F.122 
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In the definition given above we have defined the unit element as a trivial mul- 
tiplication from the right and the inverse as a right inverse. It turns out that the 
unit element also acts trivially from the left, and the right inverse also acts as an 
inverse from the left. 


Exercise F.123 Let (9,-) be a group with unit element e. Show that then for all 
5Є9 


818 =е (Е8) 
eg = 8 (Е.9) 

and that for апу h,k € 9 
gh — gk h=k hg = Ке. (Е.10) 


For a solution see Solution Е.123 


Groups which are not discrete are called continuous groups. If for a continuous 
group (9,-) the set 9 also has what is called a differentiable structure, such that it is 
a differentiable manifold, then the group is called a LIE group. Such groups are at 
the heart of not only quantum mechanics but all of quantum theory such as quantum 
field theory, elementary particles, string theory, etc. For quantum computing, how- 
ever, they do not play such a central role, which is why we do not pursue them any 
further here. 

Overall, groups are more ubiquitous than the unknowing reader might be aware 
of. Hence, it is worthwhile to consider a number of examples. 


Example Е2 As a first simple example of an abelian continuous group, we consider 
(IR, +). Here the unit element is e = 0, and the inverse of an a € R is —a. 


A first example of a discrete group is given by the integers. 


Example ЕЗ As a first simple example of an abelian discrete group we consider 
(Z, 4-), that is, the integers with addition as group multiplication. Here again, the 
unit element is e = О, and the inverse of az € Z is —z. 


Many sets of maps can also be made into groups if multiplication can be suitably 
defined. 


Example F.4 Let V be a vector space over a field F (see Definition F.53), and let 


L(V) := (M: узу Mlinear } 
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denote the set of linear maps of V onto itself. The set of linear invertible maps 
GL(V) := (M E L(V) | M"! € L(V)} 

forms a group with the multiplication 


-: GL(V) x GL(V) — GL(V) 
(Mi,Mo) _ — Mi- Mo := MM)’ 


where Му М denotes the composition of the maps M; and M». This is because the 
successive application of linear maps is associative and for any two elements yields 
another element of the set since the composition of linear maps is again a linear 
map. The identity map idy is the neutral element (also denoted by ly), and each 
element of the set has its inverse in the set. This group is called the general linear 
group of V and denoted by GL(V). If dim V > 1, it is non-abelian. 

A particular case is V = C" for n € N and F = C, which gives the group of all 
invertible complex n x n matrices 


GL(n,C) := (M € Mat(n x n,C) | detM #0}. 


Together with the usual matrix multiplication, this set forms a group which is abelian 
for п = 1 but non-abelian for n > 1. This group is denoted by СІ (п, C). It is also a 
continuous, in other words, a non-discrete group, and since the underlying set is a 
differentiable manifold, it is also a LIE group. 
Likewise, 
GL(n,R) := (M € Mat(n x n, R)| аем 4 0) 


forms a group. 


Lemma Е5 Let N €N. Then the set 9 = (0,1,..., N — 1} with the group 
multiplication given by addition modulo N, that is, 


à tz, b :— (a+b) nodN (E.11) 
is a finite abelian group (9, +zy ) denoted by Zy. 
Moreover, for a prime p the set 9 У {0} = (1,...,p — 1] with group mul- 
tiplication given by 


az, b :— (ab) mod p (F.12) 


also constitutes a finite abelian group (G~ {0},-z,,), which is denoted by 2р. 
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Proof First, consider the additive group Zy. Since (a+b) modN € (0,...,N — 1}, 
the group multiplication given in (F.11) is a map G x 8 — 9 and, due to (D.23), it is 
associative. The neutral element is е; = 0 and the inverse of an a € 9 ~ {0} is given 
by a = М№-ає $ ѕіпсе 


a--z,a | = (a+N—a)modN=0=e,. (Е.13) 
(Е.11) 


Clearly, 9 is finite and a+z, b=b+z, a. 

Now consider Z5, where p is a prime, and let a,b € (L,...,p — 1] such that 
amod p Z 0 4 bmod p. From (D.28) in Lemma D.11 it then follows that (ab) mod p 4 
0. Consequently, (ab) mod p € (1,..., N — 1}, and the group multiplication given in 
(F.12) is a map 9x (0) x 9x {0} — 9x {0}. Because of (D.20), it is associative. 
The neutral element of this group is e. = 1 since for any a € (1,..., p — 1} we have 
a-z, €. = a mod p = a. Moreover, since for any such a we have gcd(a, p) = 1, we 
know from (D.12) in the extended EUCLID algorithm given in Theorem D.4 that 
we can always find х,у € Z such that ax + ру = 1. Lemma D.9 then implies that 
xmod p = а! mod p € Gx {0} such that 


a-z, (xmod p). = (a(xmod p)) mod p, = 1. 
(Е.12) (0.27) 


Hence, every a € Gx (0j has an inverse under -z, in Gx {0}. 
Obviously, a-z, b = (ab) mod p = b-z,, a, and the proof that Z% is a finite abelian 
group is complete. 


Definition F.6 Let (9,-) be a group with neutral element e. A subset H C 9 
which satisfies 


e € X (F.14) 
heHsh'cH (F.15) 
hyo CH = hh cH (F.16) 


is called a subgroup of 9, and this is expressed by writing H < 9. 

A subgroup ‘H is called a proper subgroup of S if H С 9, and this is 
expressed by writing H < б. 

A proper subgroup H of S is called maximal if it is not a proper subgroup 
of a proper subgroup of S, namely if there is no K < 9 such that H < K. 
Likewise, a subgroup Ж of G is called minimal if there is no K < H such that 
{е} < X. 
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Example F7 Consider the group (9,+) = (Z,+) of Example F.3. For N € N define 


NZ := (Nk|k € Z} = (0, EN, X2N, X3N,...). 


This is clearly a subset of Z which contains the neutral element O of the group 
(Z, +). Addition of two of its elements Nk, NI € NZ results in N(k+/) € NZ. More- 
over, for any Nk € NZ, there is N(—k) € NZ such that adding them yields the neutral 
element 0. The case N = 1 does not give anything new since 1Z = Z, but for N > 1 
we have that NZ is a proper subgroup of Z, that is, 


М7, < 2. 


Many groups of interest in physics are subgroups of the general linear linear 
group of C" for some n Є N. 


Example F8 Let n Є №. Within the group GL(n, C) of Example F.4 consider the set 
of all unitary n x n matrices 


U(n) := {U € Mat(n x n,C) | UU* — 1]. 


The set U(n) contains the unit matrix as the neutral element, and since the product 
of two unitary matrices is again unitary, multiplication of two elements of the set 
U(n) yields another element of U(n). By definition, each element U of the set has 
its inverse U* in the set. Hence, U(n) is a subgroup of GL (п, C). It is called the 
unitary group in 7 dimensions and denoted by U(n). 

The case U(1) is special in the sense that it is an abelian group and we can 
identify it with the unit circle in C 


U(1) = (ze Mat(1x 1,C) 2 C| z- 1]. 
Moreover, within U(n) the set 
SU(n) := {U € U(n)| detU — 1) 


also forms a subgroup, which is called the special unitary group in n dimensions 
and denoted by SU(n). It is a subgroup of U(n), and we have 


SU(n) « U(n) « GL(n,C). 


Similarly, within the group GL(n, R) of Example F.4 the set of all orthogonal n x n 
matrices 
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O(n) := (M € Mat(n x n,R) | MM! = 1} 
forms a subgroup of GL(n,R) called the orthogonal group. Within O(n) the set 
SO(n) :— (M € O(n)| detM = 1) 


also forms a subgroup, which is called the special orthogonal group in n dimen- 
sions and denoted by SO(n). 


Intersections of subgroups form another subgroup as is to be shown in Exer- 
cise F.124. 


Exercise F.124 Let Г be an index set and let {H}; | j € I) be a set of subgroups of a 
group S. Show that then 
Hn := QK; 


ЈЄІ 
is a subgroup of б. 


For a solution see Solution F.124 


Definition F.9 Let К be a nonempty subset of a group б and 
еа 
the set of all subgroups that contain К. Then 


Ux) = П H 


KESK 


is defined as the group generated by K. 
A group S is said to be finitely generated if there are g;,...g, € 9 such 
that 


S = (£1.58) = (805 88)- 


A group S which can be generated from one element g € б such that 


S = (8) 


is called cyclic and in this case g is called the generator of б. 
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Any element of a cyclic group 9 = (g) is a power of the group generator, that is, 
for each g € G there exists an m € Z such that g = g”. 

The adjective cyclic may mislead to believe that the sequence (9"),,c7 may 
repeat itself, but this does not have to be the case as the following example shows. 


Example F.10 The group (9,+) = (Z,+) of Example E3 is generated by 1 such 
that as a group Z — (1) since, with g — 1, we have 


Z={+(1+---+1)|me No} = (g"|meZ). 


m times 


However, for a finite cyclic group 9 = (g) the sequence (2"),,c7 has to repeat 
itself. In this case there exists an n € N such that g" = ес, where n = [9| is the 
number of the elements in 9, and in terms of sets we have 


S= (8) o fu edu uer. 


Cyclic groups appear as minimal subgroups of groups as the following lemma 
shows. 


Lemma Е11 Every minimal subgroup HK < б of a group 9 is cyclic, that is, 
it is of the form H = (g) for some g € б. 


Proof Recall that a subgroup H < 9 is called minimal if there is no subgroup K < 9 
such that (eg) < K < X. 

Let H be minimal and g € H « (eg). If H = (g), we are done. Otherwise, take а 
k € Hx (в). But then we have 


(eg) < (8) < (g,k) SH, 


which contradicts our assumption that H is minimal. 


Another notion that will play a role in our considerations of error correcting 
codes is that of independence of elements of a group. 


Definition F.12 A subset {g1,...,g,} C S ofa group G is called independent 
if for any 2; € {g1,...,gx} 


УЕ 


Appendix F: Some Group Theory 567 
Let P denote a permutation of the index set {1,...,k}, that is, the map 


P: {1,...,k} — {1,...,К} 


j PU) 
is a bijection. 
Independence of a subset {g1,...,g,} C S of a group means that for every 
а1,...,ак € (0,1) and permutation P we must have 
А а; 
П ғ, ес aj=0 \Уўє{1,...,К}. 


This is because otherwise we would have for some j and P 


—ay —@ 


—8j-1 —a {+1 
SP(j) — 8P(j-1) i "EPS p( ЕР) (Саныч {eru} , 


and since P(j) € {1,...,k} the set {g1,...,9,} would not be independent. 


Definition F.13 Let 9 be a group and g € 9. The centralizer Clzg (g) of g is 
the set of elements of б which commute with g, that is, 


Clzg(g) := {h € 9| hg = gh} . 
The centralizer of a subset 5 C G is defined as 


С125 (5) := (h € S|hg—- gh VgeS}. (E.17) 


Exercise Е.125 Show that the centralizer of any subset 5 C 9 of a group S is a 
subgroup of 9, that is, 


For a solution see Solution F.125 


Definition Е14 Let S C 9 be a subset of the group S. The conjugate 5° of S 
by g is defined as the set 


58 := g$g ! = {ghg ! |he S). (Е.18) 


A conjugate of a subgroups is again а subgroup as is to be shown in Exercise F.126. 
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Exercise F.126 Let H be a subgroup of the group S. Show that for any g € G the 
conjugate of H by g 
HS = {ghg ! | h E H} (F.19) 


is a subgroup of б. 


For a solution see Solution F.126 


Definition F.15 Let H be a subgroup of the group S. For any g € G the set 
Ee = {ehg | h eX) 
is called a conjugate subgroup to J. If for every g € б 
JA == н, 
then 7 is called a normal or invariant subgroup of б, and this is denoted 
by HAG. 


For an abelian group any subgroup is normal. 


Definition F.16 Let S be a subset of the group б. The normalizer Norg (S) 
of 5 in G is defined as 


Norg(S) := (ge 9| S£ = S}. (F.20) 


Note that by definition 


gENors(S) © WheS Ihes: ghg! =h 
& YheS Элє5: gh—hg. 


Exercise F.127 Show that for any subset S of the group S its normalizer is a sub- 
group of 9, that is, 
Norg(S) € 9. 


For a solution see Solution F.127 


Appendix F: Some Group Theory 569 


The set of group elements which commute with every element in the group is called 
the center of the group. 


Definition F.17 The center of a group G is defined as 


Си(9):= [he S| hg- gh Yges}. (E21) 


The center is actually a normal subgroup as is to be shown in the following 
exercise. 


Exercise F.128 Show that the center of a group S is a normal subgroup, that is, 
Ctr(9) 49. 


For a solution see Solution F.128 


Definition F.18 Let H be a subgroup of the group S. For any g € б the set 
gH = (gh| h e 9c) (E22) 
is called the left coset of g, and the set 
Hg := (hg| h e H} (F.23) 
is called the right coset of g. 
If H is such that left and right cosets are identical, we only speak of cosets 


and denote them by [2] с. To simplify notation, we may at times write |g] only 
if it is clear which is the subgroup for the cosets. 


Clearly, for a subgroup H of an abelian group S left and right cosets coincide. 


Example Е19 Consider the group (Z, +) of Example ЕЗ and its subgroup (NZ, +) 
of Example F.7 for some N > 1. For any element g € Z we have the coset 
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[elvz = (a - Nk| ke Z} 
= {g,g+N,g+2N,g+3N,...} 
= {gmodN,gmodN+N,gmodN € 2N,g mod N +3N,...} 
= [g mod N]y , (E24) 


that is, any coset [e] yz Є NZ is equal to [т], where m = g mod N € (0,1,...,N— 


1}. 


If H is a subgroup of the group 9, then we have for any k € H and any g € б 


E = / / = 

KH = {kh| he H} = {K |K єзї} =H 
(F.22) 

gkH — [gkh| he H} = (gh | h eH} = 82. 
(F.22) 


(F.25) 


Lemma Е.20 Let H be a subgroup of the group S. For any two 21,22 € 9 
their left cosets gı H and goK are either disjoint or they are identical. The 
same holds for any two right cosets. 


Proof If g1 HN g2H = 0 they are disjoint, and there is nothing to prove. Suppose 
then that there is a g € g1 HN g2H, namely that there exist hj ,h2 € H such that 


gihi = g = 82/0. (Е.26) 


Since Лу,/о Є H and K is a subgroup, we have Лу ! € H. Consequently, for any 
heH 


_ -1 
gh = gihihy; h | € gi 
(F26) K (Е22) 


and thus 
RHC gi. (F.27) 


Similarly, we have ћу! EH 


= gMh! € gH 
81 82 MNI 827, 
(E20 ед (Е22) 


which implies 
BiH C. ЖК, (E28) 
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and it follows from (F.27) and (F.28) that 21107221 5 0 implies gı H = goH. 


The previous lemma allows us to prove what in group theory is known as 
LAGRANGE's Theorem, which states that for a finite group the number of its ele- 
ments is divisible by the number of elements of any subgroup. 


Theorem Е.21 Let H be a subgroup of the finite group б. Then the number 
of elements in each left coset gH is equal to the order |9€| of H, namely the 
number of elements in H. Moreover, the order of H divides the order of $ and 
G is the disjoint union of " 

J 


J=—eEN 
|| 


left cosets of K, that is, there are gj € б with j € {1,...,J} such that 6:90 
gjJ( — 0 if i jand 


J 
SENE (F.29) 
j=l 


The same statement holds for the right cosets. 


Proof We only prove the statements for left cosets here. The proof for the right 
cosets is, of course, similar. 

First, we prove (F.29). For this we pick any g € S and set g; = g. Then, succes- 
sively for j € N and as long as U}; а # б, we pick any g € G\ UL; gH and 
set gj+1 = g. By construction, we have for any k € {1,..., j} that gj41 € gH and 
it follows from Lemma F.20 that g;+1H is disjoint from all such gH. Moreover, 
since G is assumed finite, this process terminates for a J that satisfies (F.29). 

Next, we prove the statement about the number of elements in cosets gH for a 
given g € 9. For any two elements Лу, € H with hı Z hz it follows that ghi Z gh». 
Consequently, the number of elements in gH = {gh| h € H} is equal to the number 
of elements in Ж. Hence, (F.29) implies that S is the union of J disjoint sets each 
of which has || elements. Therefore, the number of elements in 9 is given by 
IS] = Л. 


We know already that for abelian groups left and right cosets of any subgroup 
coincide. This is actually a general property of normal subgroups of any (not neces- 
sarily abelian) group. 


Exercise F.129 Let H be a subgroup of the group б. Show that then 


H is normal © gH=Hg Vege. 
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For a solution see Solution F.129 


For a normal subgroup we thus do not need to distinguish between left and right 
cosets. Moreover, the set of cosets of a normal subgroup can be endowed with a 
multiplication and made into a group itself as the following proposition shows. 


Proposition Е.22 Let 9 be a group with neutral element e and let HG. 
Then the set { |g] sc | g € 9} of cosets forms a group with 


multiplication: forall g1, 22 € 9 


[gilsc: [s2loc := [gisele » (Е.30) 
neutral element: 
0х = Ж, (E31) 
inverse: foreach g € 9 
ddo = [e [ш- (E32) 


Moreover, for any g1,g2 € 9 we have 


[gils¢  [22]5c = һЄ Н: в =gh. (Е.33) 


Proof Since for any 21,92 € 9 we have gi g2 Є S, the multiplication defined ір (F.30) 
is a binary map 


-: {Ielac | 8 <9} х { [8] lees) — { [8] |869) 
(sils [82]2c) — [#182] 


, 


and associativity of - follows from associativity in 9: 


(Ie1]5c (827) [83] ос = [182]5c l3] = (l8182)83] = [818283] 
(F.30) (F.30) (ЕЛ) 


To show that the product as defined in (Е.30) does not depend on the particular 
gı and g» chosen to represent the cosets [g1]4, and [g2]4,, requires the invariance 
property of H. For this let ic {1,2} and g; € 9 be such that 2; Z gi, but [2] = 
[g;]3;. Then there exist ^; € H for i € {1,2} such that g; = gih; and thus 


[8182] зс = [gii gaha]gc, = [en ez]ac - (F.34) 
(R25) 
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Since H is assumed normal, Definition F.15 implies that for any h € 9€ and 8Є9 
there exists ап h Є H such that ghg| = = h and thus gh— hg. Using this for h = hi 
апа g = go in (F.34) gives 


[212] = [812182] = [eio]. = [8182] 
(Е25) 


which shows that the product of two cosets [21]5, [82] as defined in (F.30) does 


not depend on the choice of the g; to represent the cosets. 
For any g € б we have 


[else lele = вое — loc 
(Е.30) (Е2) 


which proves that [е]; is indeed the neutral element. 
Finally, 


[819 (18150 = Па] [87 "se = [88 loc lec: 
(F.32) (F.30) (ЕЗ) 


which verifies that every [g], has an inverse in { [gl ac | gE 9}. 
To prove (F.33), let g1, g2 Є S. Then we have 


[21]oc = [82] 


€ {gihi| hy E H} = {00| ho € H} 

(F.22) 

e Wh, eH dh, €39Cand Vh; EH Эл EH: gihi = goho 

е Vh €9€ 3h;€9(and Vh? eH 3h € 9€: gi = galohj! 
М, 


=heH 


e She Н: е =gh. 


For a normal subgroup, the statements in Proposition F.22 allow us to define a 
group that consists of cosets. This group formed by cosets is called is the quotient 


group. 


Definition F.23 Let H be a normal subgroup of the group б. The group 
({ lels | g € G},-) given by the cosets of H in 9 with the multiplication, 
neutral element and inverses as given in (F.30)-(F.32) is called the quotient 
group of H in 9 and denoted by 5/9. 
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Example F24 Consider again the group (Z,+) of Example E.3 and its subgroup 

(NZ,+) of Example F.7 for some N > 1. The group multiplication of two cosets 

[gilwz>|82lvz € Z/NZ, which we write as +z/yz since we are dealing with an 

abelian group, is then given by 
[e1]wz +z/wz [82]wz £i mod N]y; +z/wz [82 mod N] yz, 

gi mod N + g2 mod N] yz 

(gı mod N + g2 mod N) mod N] yz 


(81+ 82) mod N]yz 


[(g1 +2y 82)] yz > (E35) 


where --z, is the group multiplication in Zy of Lemma Е.5. 


For a finite group, the number of elements in a quotient group of any of its sub- 
groups is indeed the quotient given by the number of elements in the group divided 
by the number of elements in the subgroup as the following corollary shows. 


Corollary E25 Let H be a normal subgroup of the finite group S. Then the 
order of the quotient group G/H is given by the quotient of the orders of 9 
and K, namely 

Sl 


| 
Hi = LSL F.36 
19/2] | (F.36) 


Proof From Theorem E.21 we know that there are exactly de distinct cosets in 


{ [glac | 8 € 9}. which is the set of elements of the group 9/2. 


Hence, any normal subgroup of a group gives rise to a new group formed by their 
quotient group. This is one way to construct new groups from existing ones. 

Another way to do this is by forming the direct product group of two groups 
(81,:1) and (S2,-2). The underlying set of this group is the cartesian product, and 
multiplication is defined component-wise in each of the groups. 


Exercise F.130 Let (;,:6,) and (92, :5,) be two groups. Show that the set 91 x 92 
together with the multiplication 
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(1,82) x (81:82) = (81:9, £1 82:9, 82) (F.37) 


forms a group, and that if $ and б» are both finite, this group is also finite and 
satisfies 


[$1 x Go| = |81||S2]. (F.38) 


For a solution see Solution F.130 


As a consequence of the statement in Exercise F.130, we can give the following 
definition. 


Definition F.26 Let (91, :5,) апа (95,:5,) be groups. Their direct prod- 
uct group (91 х G2,°x) is defined as the set of pairs (g,k) € 81 x 92 with 
component-wise multiplication 


x + ($1x 92) x ($1 x G2) — 91х92 


: F.39 
(81,82), (81,85) = (81:9, 818292 82) nsn 


Before we turn to maps between groups and related concepts, we introduce the 
notion of a (left) action of a group on a set and that of a stabilizer on a set. 


Definition Е27 Let S be a group with neutral element e and let M be a set. 
A left action of 9 on M is defined as a map 


A:S9xM — M 
(e,m) —> g.m 


that satisfies for all h, g € 9 and m € M 


em=m (F.40) 
hg.m = h.(g.m). (Е41) 


The stabilizer of a subset О С М under the left action is defined as 


Stag(Q) := (ge 9| g.m-2 m VmeQ}. (R42) 


Exercise Е.131 Let 5 be a group which acts by left action on a set M. Show that for 
any subset О C M its stabilizer is a subgroup of 9, that is, 


Stag (Q) <9. 


576 Appendix F: Some Group Theory 


For a solution see Solution F.131 


Е2 Homomorphisms, Characters and Dual Groups 


Another way to connect two groups is by maps from one group into the other such 
that the group multiplication in each of the groups is preserved by the map. Such 
maps are called homomorphisms. If, in addition, they are bijective, they are called 
isomorphisms. 


Definition F.28 A homomorphism between two groups (91, :5,) and (95,:6,) 
is a map Q9 : 9; — Gp that maintains the group multiplication, that is, which 
satisfies for all g,h € б] 


Ф(&)-с› Ф(Л) = o(g:s, h). (Е.43) 


The set of all homomorphisms from a group 9 to a group 92 is denoted by 
Hom(91, 92). 

The pre-image in 9, of the neutral element e? € 92 under a homomorphism 
@, namely the set 


Ker(9) := {8 € Sı | 9(2) 2 e2}, (F.44) 


is called the kernel of о. 

А map 9 : G — S is called an isomorphism if it is a homomorphism and 
a bijection. Two groups б and 92 are said to be isomorphic if there exists an 
isomorphism between them, and this is expressed by the notation 9 2 95. 


Example F29 Consider again the group (Z,+) of Example ЕЗ and its subgroup 
(NZ,+) of Example F.7 for some N > 1. We will show that the quotient group 
Z/NZ is isomorphic to the group Zy, which was defined in Lemma Е.5 and which 
consists of the integers (0,1,..., N — 1} with multiplication given by addition mod- 
ulo N. More precisely, we will show that the map 


1: Z/NZ — Zy (F45) 
[g]vz > gmodN 

constitutes an isomorphism between the two groups Z/NZ and Zy. 

To begin with, we show that z is well defined, in other words, that the image 

i([g]yz ) does not depend on the g € Z chosen to represent the coset [g] yz. To see 
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this, let g1, g2 Є Z be such that [gi]yz = [g2lyz- Then it follows from (F.24) that 
[g1 mod N] yz = [g2 mod N] yz. Since g; тойм € (0, 1,..., N — 1} fori € {1,2}, this 
implies gı mod N = gy mod N, hence, 1( [e1]yz ) = ([22]wz )- 

Now, suppose 21,8» € Z are such that [gi]yz Æ [g»]yz. Then it follows again 
from (F.24) that gı mod 5 g2 mod N, since otherwise their cosets would be equal. 
Consequently, 1( [e1]yz ) # :( [62], ), which means that z is injective. It is also sur- 
jective, since, again using (E.24), every m € (0,1,..., N — 1] uniquely defines a 
coset [m] yg, which also satisfies 1( [m] yz ) = m. Therefore, г is a bijection. 

It remains to show that z is also a homomorphism. For this we apply : to both 
sides of (F.35) to obtain 


:( [81] +2/w2 [gala ) = (1081 +82) mod N] yz ) 
35) 
(gi +82) mod N 

) 

= gı mod N +z, g? mod N 

(E11) 

UT ([gilvz) +2 ([e2]yz ) > 
(Е45) 


hs 
л 


м] 
pw 
Ur 


which shows that : satisfies (F.43), hence is also a homomorphism. 
Altogether, we have thus shown that 


Z/NZ Zn. (Е.46) 


As a result of (E.46) we shall no longer distinguish between Z/NZ апа Zy and also 
use the notation [т] yz to denote an element m € Zy. 


Lemma Е.30 Let ф € Нот(91,92) be a homomorphism between the two 
groups 9 and 92. Then Ker(@) is а normal subgroup of 91, that is, 


Кег(ф) 491. 


Proof We first show that Ker(@) is a subgroup of 9. For i € {1,2} let e; denote the 
neutral element in 9;. For any g € 8$, we have 


e(e)e()(e(9) = ele) loe) = elele) 


Ф(е) =, 
(K3),(E.2) (F.43) (F.9) 
(Е.3) 


Dy 


€2, (F.47) 
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which shows that e; € Ker(@) and verifies (F.14). 
Next, for any ^ € Ker(@) it follows that 


ES! EN —1 EN —1 EN —1 = = 
Q(h ) = exe(h ), = ,e(h)e(h ) = e(hh ), = Фф(е) =e, 
(F9) (F.44) (F.43) (ЕЗ) (Е47) 


which shows that h~! € Кег(ф) and verifies (F.15). 
Finally, for any 1,5; € Кег(ф) 
(hıh) = ,9(hi)e(Ih;), = exe» = es, 
(FA3) (F44) 


which shows that hıh € Ker(q) and verifies (F.16). 

Now that we have shown that Кег(ф) is a subgroup, it remains to show that it 
is normal. For this let g € 81 be arbitrary and let / € Ker(q)£, that is, there is an 
h € Ker(q) such that h’ = ghg^!. Then we have 


Ф(#') = e(ghg !) = elole) = e(g)exo(g ') 
(Е.43) (F.44) 
= e(s)e(s |) = 0(sg') = 9(e1) 
(Е43) 
= е2, 


which shows that for апу g € 9] we have that h’ € Кег(ф)# implies /' € Ker(q). 
Hence, we have shown that 


Ker(@)® C Кег(ф) Vg € 91. (F.48) 


To finally show the reverse inclusion, let ^ € Ker(@) and g € 91 be arbitrary. Then 


k=g hg (F.49) 
satisfies 
Ф(Ю = o(g hg), = ol elhel) = ol  )exo(g) 
(F.43) (F.44) 
= Ф(в-!)Ф(в) = (8 !g) = ф(е1) 
(Е.43) 
= 
(Е.47) 


such that k € Кег(ф). But then it follows for the arbitrary ^ € Ker(@) that 


һ = gkg! € Кег(ф)#. 
(Е49) 
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Consequently, we have 
Кег(ф) C Кег(ф)* Vg € 91, 


which, together with (F.48), finally proves that Ker(@) = Ker(q)* for all g € 91, 
that is, Кег(ф) is a normal subgroup of 91. 


Exercise F.132 Show that any homomorphism @ : G; — 92 between two groups 91 
and 9» satisfies 


Ф(в-!)=ф(в) Yges. (F.50) 


For a solution see Solution F.132 


The following theorem is called First Group Isomorphism Theorem and is also 
known as the fundamental homomorphism theorem. It states that the for a homo- 
morphism the quotient group over its kernel can be identified with its image. 


Theorem F.31 (First Group Isomorphism) Let бү and б» be groups and let 
9 € Hom(91, 92). Then we have 


91/ Кег(ф) = ф{91}, 


where the isomorphism is provided by the map 


9: 91/ Кег(ф) — eto 


[s]ker(o) Кс} Ф(в) iod 


Proof From Lemma F.30 we know that Ker(@) is a normal subgroup of 91, and we 
can define the quotient group 91 / Кег(ф). To show that @ is an isomorphism, we 
first show that it is well defined. For this let, ga, 2, € 91 and [2] ker(o) E [8b] Ker 
Then we know from (F.33) that there exists an Л € Ker(@) such that 


9) 


ga = gph. (Е52) 


Consequently 


P( [8alker(g)) =, Ф(8а) = Plh) — eloh) =, Фф(вь)ез = ols) 
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proving that ф is well defined. Here, as usual, ез denotes the neutral element іп 92. 
Injectivity of Ф is proven by the following chain of implications for ge, 4 € 91: 


Ф({вс]кеце)) = P([8alker(p)) > Plec) = 9(ga) => (ga) Plg) = e 


—— 

(E51) 

o, (87 8с) = е2 =>, s, 8 € Кег(ф) 
(Е43) (Е44) 


Эл є Ker(@): ge = gah 


=> 
=, [ёс]кег(ф) = [8alKer(o) - 
(F.22) 


To show surjectivity, note that ф{91} = (9(g)| g € Si}. Therefore, for any л € 
9191] there exists a g € 9, such that 


proving that @ is surjective as well. It remains to show that @ is a homomorphism. 
For this consider 


$ (Isile) #21кецф)) So ®([8#18°]кее)) 00182), = (81) 022) 


(K.30) (E51) (F43) 
aa б( [81]кег(ф) )e( [22] ker(g) ) Ш 
(F51) 


which shows that indeed Q € Hom (91/ Кег(ф), 9(91]). 


A very useful class of homomorphisms for the study of groups are the so-called 
characters of a group. They can be defined for any group, but for us the special case 
of abelian groups suffices. 


Definition F.32 A character of an abelian group 9 is defined as an element 
X € Hom (С, U(1)), where 


U(1)= {zEC| z=1} = {|a eR] (E.53) 


is the special unitary group in one dimension. 
For any character x of an abelian group 9 we define the conjugate char- 
acter y as 
xs 1 
= (R54) 
g = Kle) 
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A special character for any abelian group G is the trivial character 


15: 9 — (1) 
giu 


, (Е.55) 


which maps any group element to 1 € U(1). 


Note that by definition any character у of an abelian group б being a homomor- 
phism from 9 to U(1), it satisfies for any g1,g2 € 9 


Х(81 +9 82) — x (21)x (2); (F.56) 
(F.43) 


where +g denotes the group multiplication in the abelian group б, whereas on the 
right side the product is in U(1), which is just a multiplication of two complex 
numbers of unit modulus. 

As a consequence of (F.56), any character of an abelian group has to map the 
neutral element e of the group б to 1, that is, we have 


x(a se) 
(е) = 22 2 =1 (F.57) 
ps x() 


since g +g e = g. Actually, this statement already follows from Lemma F.30 since 
as a subgroup Кег(х) = {g € 9| x(g) = 1} has to contain e. 
Moreover, since y(g) € U(1) 


1, = x(8)x(8) — x ()x(9): 
(E53) (E54) 
we have 
X(s) = (8) „= (8). (Е.58) 
(F.50) 


Example F.33 For the group Zy defined in Lemma Е.5 and considered in Exam- 
ple F.29, we have the characters 


Xn: Zn — U(1) 


Юла en “| 


where n € (0,1,...,N — 1}. 
To verify (F.56), we note that for any [gi]wz ,|22]yz € 2м 
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Xn (lei]wz zu lexlyz ) = %( [(g1-- 22) mod N] yz ) 


(F35) 
Mm 

р, 

(Е.59) 

a Xal [21]vz Jet [22]z ) . 

(Е.59) 


The kernel of a y, consists of all cosets [2] wz, Such that Ei € Z, that is, for which 
ng mod N — 0. 


The characters of an abelian group again form a group. 


Theorem E34 The characters © = Hom (S, U(1)) of an abelian group б 
form an abelian group with the the trivial character 1o as the neutral ele- 
ment and with the group multiplication 


к i M (F.60) 
(01,0) > 7172 
where Xx» is the character 
qn: 3 — ЧІ) (R61) 


8 э %ı(8)x2(2) ` 


Proof To show that G is a group, we need to show that the multiplication of two of 
its elements as defined in (F.60) gives again an element of 8, that there is a neutral 
element for this multiplication, and that every element has an inverse in 8. 

Let xi, о € g and g1,g2 € 9. Then we find 


22 (81) (82), = X1 (81)%2(81)X1 (82)x2(82) — X1 (82) (8182) 
(E.61) (F.43) 
nan (i82) 
(Е.61) 


and y, y» as defined in (Е.60) and (Е.61) is indeed an element of Hom (S, U(1)). 
For any 7 € G апа g € 9 we have 


x18) = x(8)1s(8) = xa) 


(R61) (Е.55) 
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such that the multiplication (F.60) gives indeed yl = y for any х € @ and 1g is 

the neutral element. n 
Finally, for any x Є 9 its inverse is given by its conjugate character Y € 9, since 

for any g € 9 

1. (Е.62) 


Definition F.35 Let 9 be an abelian group. The group G := Hom (9,0(1)) 
formed by its characters with the group multiplication given іп (F.60) and 
(F.61) is called the dual or character group of б. 


Theorem Е.36 Let H be a subgroup of the finite abelian group S. Then any 
character of H can be extended to a character of б, and the number of such 


181 


extensions is THI" 


Proof To begin with, we recall that subgroups of abelian groups are always normal, 
so we can always form quotient groups with them. 

If H = б we are done. Otherwise, we have H < 9 and can pick a g € GN X. 
Let Hı = (K, g1) denote the subgroup generated by the set HU {g1 } such that 


Hy = (965) = (hg | Ae 9Gme Z} 


and 
HKH<Hı <9. 


Furthermore, we set 
k:= min (n € N| gi e Xt), (F.63) 


which exists since at least gi’ = eg € H for some finite m € N. Consequently, for 


any character yy; € H, we have that x (8%) =e! € U(1) for some о € R. There are 
k k-th roots of e!*, which are of the form 


_ &-2nl 


Bu forl € (0, L,...,k— 1}. 


These satisfy 
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which implies 
ui) = xxt) (F.64) 


for each | € (0,1,...,k — 1}. For each such / we want to define a character y; € 96, 
which acts on a generic element Ag] € Hı by 


3i (hgl) := до‹(А)ш(в1)7. 


For this to be a meaningful definition, we need to make sure that the right side 
does not depend on the particular h апа g1 but only their product hg}. To show this, 


suppose that h,h € Жапа ie Z are such that j> jand 
hg] = hg]. 


From this it follows that 


ві! = eK (Е.65) 
and since (F.63) implies that k is the smallest natural number such that gk € H, we 
must have 7 

j=jt+mk (F.66) 
for some m € N. Therefore, (F.65) implies 


h = Һа". (F.67) 


Consequently, 


3c) e)? = g ulg) H = ac (8) (ui Gr") " ui 


(Е.43) 


Хәс()ш(е1)?, 
(F.67) 


WY 
(F.66) 
CLA (h) (xac (25) uu (gi)! = Xa (hg?) ui (gi)? 
(F.64) 
<> 


and 
XI: Hy —À U(1) 


. F. 
hgi — xoc(h)ui(gi) mon) 


is well defined. Moreover, for any hig” € Hı, where i € {1,2}, we have 
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xhg hog?) = (тт!) (nho) (gi)? ^? 


ек 
(Е.68) | 
= J J 
Z Xscün uii)" (о) mi (81)? 
(F43) 


чә 


=, (Ig! )xi(Img?), 


(F.68) 


showing that y; € Hom(2 , U(1)), in other words, y; is a character of Hı = (H, g1) 
that satisfies xila = XK. 


There аге k such extensions xo, . - . , Xk-1 Of yx to Hı and since 81,82, фе: er ¢ 
Ж, we have 


Ж = (Ж, в) = les] Өс Ч-СЫ [st "] „ (F69) 
such that ix | 
Hy /9€ PH _ к 
| i |. А IH] Мар 
(Е.36) (Е.69) 


We choose апу of these extensions and denote it by х7. We thus have a subgroup 
JC, and a character уз, € H1. Now we pick any g2 € 9 У Hı and repeat the previ- 


ous construction with H2 = (201, 22) leading to a character Хю € Hy that satisfies 
Хн lc, = ўа. We continue with this until there is no more gn+1 € G\ Hy to be 
found, which must happen after a finite number of steps since 9 is assumed finite. 

Altogether, we thus have a sequence of subgroups H, = (H,—1, 87-1), elements 
gr € G\ 96. and characters y, € F, for r € {0,1,...,n} such that 


HKH=Ho< 96 <- «396,—9 


Жж, Fersi = X964 


X9 


K = Хн, HK = (X56 95.) lit = Ж, lac = = Доо = XX 


In each step from r — 1 to r we have E = possible extensions. The number of ways 


in which yy can be extended from a character on H = Ho to one on $ = H, is thus 


"t Del 9 18, 
„ж ol pj 


A direct consequence of Theorem F.36 is that the dual group of a finite abelian 
group has the same number of elements as the group itself. 
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Corollary F.37 The dual group @ of a finite abelian group S satisfies 


S] = I9]. (F.70) 


Proof Let e be the neutral element of the group 9. The subgroup (e) has only one 
element, that is, |(e)| = 1. Moreover, its only character is the trivial character 1(5, 
which, according to Theorem F.36, can be extended in exactly 


18] _ 
jar" Sl 


ways. Any character y € 8, when restricted to (e), is equal to 1e}. Hence, it must 
be one of the |S] extensions constructed from lt since, otherwise, there would be 
more than |9| extensions. Consequently, the number of characters 15 |9]. 


Exercise F.133 Let 9, and 92 be two finite abelian groups and [^ and iG, their dual 
groups. Show that the direct product group satisfies 


Gi x $9 = $1 x Sp. (E71) 


For a solution see Solution F.133. 


Corollary F.38 Let б be a finite abelian group with neutral element е and 
g € GN (e). Then there exists a character y € 9 such that g ¢ Ker(x). 


Proof Let g € Gx (e) be given. Since 9 is finite, there exists a smallest n € N such 
that n 1 and g" — e. With this n we define 


He: (g) — UC) 


Since any element g € (g) can be written in the form g = g” for some m € Z, we 
have that Li, is indeed defined on all of (g) and for any g; = 8" € (g) with i € {1,2}, 
obviously, 


‚тү+ту 
"7 us(n)us(g)- 


Ug(8182) = ug (g^! 2) = е2" 
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Hence, Li, is a character of the subgroup (g) < 9, and it satisfies L1, (g) = em % 1. 
We then apply Theorem F.36 to the subgroup (g) to extend the character И, to a 


character y € G such that Xl = ц, and thus x(g) # 1. 


Lemma F.39 Let H be a subgroup of the abelian group 9. Then 
H+ := (x € G| Жс Ker(y)] (Е72) 


is a subgroup оў д. 


Proof Let eg denote the neutral element of the dual group д. Since eg = lg and 
Ker(1g) = 9, we have H C Ker(eg) and thus eg € (+, proving (F.14). 


Next, we show that H+ is closed under multiplication. For this let %1, yo € H+ 
and h € H be arbitrary. Then we have 


saxla) =, 1. 
(Е.61) heHcKer(y;) 


40 


Hence, yix» € H+, and (F.16) holds. 

It remains to show that for any 7 € H+ its inverse lies in H+. From (F.62) we 
know already that the conjugate character % is the inverse of y, so we only need 
to show that it is an element of H+. For this let / € H be arbitrary. Then y € H+ 
implies that ^ € Ker(x) and thus y (Ah) = 1 from which it follows that 


Consequently, x^! = x € H+, and we have verified (F.15), which completes the 
proof that H+ is a subgroup. 


Example F40 Let eg denote the neutral element of the group S and eg that of the 
dual group $. For the trivial subgroup (eg) « S we find 


(eg) = (x € 8| eg € Ker(x)} = 8, (Е73) 


whereas for the trivial subgroup S itself 


8® = (x € | 9 C Ker()) = (19) = (ег). (ЕЛ4) 
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Exercise F.134 Let H be a subgroup of the finite abelian group 9, and let H+ be as 
defined in (F.72). Show that then for any y € 9 


Е a. 
Y (h үү if y cH б 


hed else. 


For a solution see Solution F.134 


Corollary Е41 Let б be a finite abelian group and G its dual group. For any 
Xi, X2 € S we then have 


У x(e)x(8)= | if %2 = 


mr else. 


Proof 
19| е. 8) 
У Х1(®)72( К 2, zc) = (E74) 
g9 (R61) #9 (ЕЛ5) [0 else. 
А ET 
= u if %2 = А (F.76) 
0 else. 


Exercise F.135 Let H be a subgroup of the abelian group 9 and let H+ be as 
defined in (F.72). Show that then 


к< [\ Kex) (ЕЛ7) 
yeHt 


For a solution see Solution F.135 


It turns out that in the case of abelian groups we have that H+ is isomorphic to the 
dual of the quotient group 9/H. 
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Theorem F.42 Let K be a subgroup of an abelian group б and H+ as 
defined in (F.72). Then we have 


КЕ = 9/9. (F.78) 


Proof Let eg denote the neutral element in the group б and eg уос that in the quotient 
group 9/H. For any Е € 8/3, we define 


и , (F.79) 


ig (A), = 2 (Aloe) =F (lesloc) =F (es) =! 
(F.79) (F25) (ЕЗ1) (Е.57) 
such that H C Ker(iz) and thus 
ip xg (F.80) 
we 
(ЕЛ2) 


Moreover, for £1, £5 € 87% and any g € 9 


satisfies E 
1 € Hom (S/H, H+). (Е.81) 


Now that we have established that г is а homomorphism it remains to show that it is 
also a bijection. To accomplish this, we define for any y € H+ 


jx: $/H — U(1) 


Isla > x(8) ` pea 


This is well defined since [g1]4, = [82] implies g2 = g1h for some h € H and thus 


Sex) „=, (а), 
(F.43) hEHCKer(%) 


X(22) = x% (81h) 
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where in the last equation we used that y € H+ implies g(h) = 1 for all h € H. 
Moreover, for апу [2i]5 , [82] € 9/H we have 


illesd jlls) = xexe) = д (кто) = fx ln loo 


(F.82) (F.43) (F.82) 
dx (1811 [22]50 - 
(F.30) 
Hence, we have E 
Л Є S/H, 
and the map ce 
ji qc — 9/3 
X э Л 
satisfies 


j € Hom (3+, 5/5) . 


The composition го j : H+ — H+ satisfies 


го (x): 9 — U(1) 
8 —— 14 (g)' 


where А 
1,08) — zll) = ,Х(8), 
(Е79) (Е.82) 


such that zo j(%) = x, that is, every y € H+ is an image under г of a coset j(7) € 
G/H, which implies that z is surjective. 


Likewise, the composition јот: G/H — S/H satisfies 


where now 


such that jo1(&) = Е. From this it follows that for any 21,22 € S/H satisfying 
Жү x Жо we must have j o1(£1) Æ joi(52) and thus (Ж) Æ 1(52), proving that z is 
injective as well. 
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Hence, we have established that z is a bijection and because of (F.81) thus an 


isomorphism, which completes the proof of H+ 2 87%. 


Corollary Е43 Let H be a subgroup of the finite abelian group 9 and H+ 
be defined as in (F.72). Then we have 


po. (Е.83) 


Proof With Theorem E.42, we have 
pe: = 1877] = 19/30, =Й. 
Ww Ww м || 
(ЕЛ8) (ЕЛО) (Е.36) 


Theorem Е.44 Let Бе a subgroup of the finite abelian group § and H+ be 
defined as in (Е72). Then for each g € 9 У H there exists a y € H+ such that 
g € Ker( x% ), and we have 


х= бә}. (F.84) 
yeHt 
Moreover, if the y1,..., Xy € H+ are such that H+ = (y1,..., xz), then 


L 
H = (| Ker(xı) 
E 


holds. 


Proof As a subgroup of an abelian group H is normal and thus Proposition F.22 
tells us that there is a quotient group 8/2. Let eg denote the neutral element in 
the group 9 and eg 5, that in the quotient group G/H. Applying the statement of 
Corollary F.38 to the group 9/2 means that for each coset [e]5; 4 [eg]a¢ = евуж 


there exists a у. € 9/3 such that 


[8] € Ker(Xfejge)- (K.85) 
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For g € S, let 


Cg: 9 — U(1) 


F — хы, (llo ' (Баб) 


which satisfies 


Сеат) бе (82), — „Хв (E8110 Xela (182190 = Mlelac 181]‹ [82]‹) 


(Е.86) (F.43) 
(181821) — (8182) (F.87) 
(F.30) (F.86) 
as well as for any h € H 
Celt) = Xela (Ин) = Xt FO — Mela (69/00) = 1, (F.88) 
(F.86) (Е25) (Е31) 
whereas 
Ge (8), — Mela (1850, + (F.89) 
(F.86) (F.85) 


From (F.86) and (F.87) we see that $, € Нот(9,0(1)) = and from (F.88) that 
9€ C Ker(C,), which together implies C, Є H+, while (F.89) implies g ¢ Ker(C,), 
which completes the proof of the first part of the statement in the theorem. 

From Exercise F.135 we know already that 


HZ N Кег(7). 
xe9sc- 


But we have just shown that for any g ¢ H there exists a y € H+ such that g ¢ 
Ker(x). Consequently, such a g cannot be in the intersection of all y € H+, and we 
must have 

H= N Кег(7). 


xe 


Now let H+ = (y1,..., XL). This means that for any y € H+ there exist m),...,mz € 
Z such that 


my ту, 


х=, 
Hence, for any g € 9 
m, А 


Кее 2 s ()^ Qu)". 
(R61) 
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Consequently, h € (Vj, Ker(yj) implies Р € Ker(y) and thus for any y € H+ 


L 


(Keri) € Кег(у) 
1=1 


from which it follows that 


L 


(|Kerx) € f] Ker(x (F.90) 


l=1 уе 


On the other hand, since y1,..., yr € H+, we also have 


L 
(| Ker(x) € [Т|Кег(у). (E91) 
wen Ii 
Together, (F.90) and (F.91) imply 
2 Ker(y) = [| Ker(x),— c 
l хє =“ 
o 


Finite abelian groups are isomorphic to the dual of their dual group. 
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Proof From Theorem Е.34 we know that the dual group @ of a finite abelian group 
9 is a finite abelian group as well and applying the statement of that theorem to S in 


turn implies that G is a finite abelian group, too. From Corollary F.37 we also know 


that ISI = |S| and thus also ISI = ISI = |S], that is the group © has the same number 
of elements as the group б. 
For any 21,2» € 9 and y € 9 we have 


ES 


(8182) = x(81)4 (ео) = О) аА). 


(Е.45) (Е.61) (F45) 


£182(X) 


Hence, ET = Б $. and it follows that ^ € Hom(G, 8). Могеоуег, Бї = Б implies 
that for any x € 9 


AG) eU = Ф(Х) = e) (F.93) 
(FA5) (FA5) 
and thus 
xls ) = x (x (e ) = x (GUx(2) E 
(F.61) (Е.50) (F.93) 


for any y € G from which it follows that g1 g3 l= eg and thus gı = g2. Hence, the 


map ^: 8 — 9 is also injective, and since 9 has the same number of elements as 9, 
it is also a bijection and altogether an isomorphism, which was to be shown. 


Lemma Е.46 Let H be a subgroup of the finite abelian group 9 and К+ as 
defined in (F.72). Then we have 


(30) =H. (Е.94) 


Proof For any h € Ж and y € H+, we have 


where ^ denotes the isomorphism defined in (F.92). Hence, 


пе (H+) = (E € | 3€ c кецё)}, 


and it follows that 
jc. (F95) 
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Applying the result of Corollary F.43 to the subgroup H+ < 5 gives 


ne. D a ISL 
IR) I pa м4 mr = 120, 
(Е.83) (Е.70),(Е.83) | 
А : TT nw 
which, together with (F.95), implies (9€ ) =H 


Example Е47 Applying (F.94) to the trivial subgroups of Example E.40, we find 


(es) = (es) )  — 8°, 
(F.94) (Е.73) 


whereas for the trivial subgroup 9 itself 


Ses (Ses (F.96) 


(F.94) (F.74) 


Theorem Е.48 Let Hı and Hy be subgroups of the finite abelian group 9 
and let Hy and Hy be as defined in (F.72). Then we have 


31«960-9 e ML zG (Е.97) 


Proof From Lemma Е.39 we know already that Ht and Ht are subgroups of д. 
Now let Hı < Ha and y € H+, which, on account of (F.72), implies 


Hy C 96 C Ker(x) 
and thus, using once more (E72), y € Spe. Consequently, He < ңү, but from 


Theorem E.44 we know that for each g € H2 У H there exists a y € 9 such that 
€ Ker(x). Hence, Hy < H+, and we have shown that 


Ж «96 x9 > 9 «90 «8. (F.98) 
From Corollary F.37 we know that G is a finite abelian group and from Lemma F.39 


that Ht and Ht are subgroups of G, Hence, we can apply the result (F.98) to these 
groups, which gives us 


Ht «9: «8 (Kt)! < (И)! « 8. (F.99) 
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Theorem F.45 tells us that we can identify G with S and Lemma F.46 that (Жү) ы 
+H as well as (H4) = Ж. Therefore, (F.99) becomes 


JG «90 «8$ > 3JG«960x89, 


and the proof of (F.97) is complete. 


Corollary F.49 Let 9 be a finite abelian group, @ its dual, H < б a proper 
subgroup and H+ « б be defined as in (F.72). Then the following hold 


H maximal <= H- minimal 


(F.100) 
H minimal <= ÒH- maximal. 


Proof Let H < б be maximal. Hence, there is no K < 9 such that 


H<K< © „= leg)". 


(F.96) 
Theorem F.48 then implies that there is no subgroup M < $ such that 


(eg) = (eg) ) «M « 9c (F.101) 
(F.94) 


because, if there were such an М, then it would follow from (F.97) that the sub- 
group M+ would satisfy H < M+ < 9, which contradicts the assumption that H is 
maximal. Hence, there can be no M satisfying (F.101) and H+ has to be minimal. 
Now let H+ be minimal, which means that there is no subgroup K satisfying 
eg <Х< HH. 
Then again, Theorem F.48 implies that there is no subgroup M « S such that 
JC« M «S9 (F.102) 


because, if there were, then (F.97) would imply 


(eg) = 5° < M^ < HF, 


Appendix F: Some Group Theory 597 
which contradicts H+ being minimal. Consequently, there can be no M satisfying 
(F.102) and 1 has to be maximal. 

So far we have shown 


H maximal <= H+ minimal. 


Applying this statement to the subgroup H+ < G yields 


H+ maximal © Gey = H minimal. 
Seed 


(Е.94) 


With the previous results we can finally establish a lower bound on the probabil- 
ity that a finite abelian group is generated by a randomly selected set of elements. 
This result will be useful in the context of the Abelian Hidden Subgroup Problem 
discussed in detail in Sect. 6.6. 


Corollary F.50 Let g1,...,gr be a set of elements of the finite abelian group 
S that have been selected at random, independently and with replacement 
from the uniformly distributed elements of 9. Then the probability that the 
whole group is generated by this set satisfies 


191 


К (Е.103) 


PIG ар аР 


Proof We show the claim by first deriving а bound оп the probability of the сот- 
plementary event { (81, 321) < 9} and then use that 


P{(g1,...,92) = 9) - P((gi,...,g) <9) =1 


If (g1,...,g1) = 9, there is a maximal subgroup H of 9 such that 
(8&1,...,81) < < G. 


From (F.36) we know that Ge € N, and since H « б, we must have 


9. 
— > 2. F.104 
|= ( ) 


Hence, when а g; is selected at random from the uniformly distributed |9| elements 
of 9, the probability that it is in H satisfies 
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itc 1 


IS] -—2- 
(F.104) 


Pig, EH} = 


When independently selecting L elements g1,...,g7 in this fashion, the probability 
that they are all in H thus satisfies 


1 
P(gi,. sg. e X) S 5. (F.105) 


Hence, the probability that the g1,...,gz are all in any maximal subgroup H < 9 
satisfies 


g1,- -8LEH for = 
Eu = х. P{g1,-.. 8L EH} 
H<9 maximal 


=, У Р(8--.8.620 
(F.100) H+<G minimal 
number of minimal subgroups of g 


ч” 2L 
(Е.105) 


From Lemma F.11 we know that any minimal subgroup of G is of the form (x) for 
some x € S. Hence, 


number of minimal subgroups of G< ISI 


such that 
P 81,8, EH for < 181 
any maximal H < G | = 


from which follows that 


© 
Р{(#1,...,81) « 9} < E 
Consequently, 


19] 


P{(21,... 8L) = 9} =1—P{(g1,...,81) <9} > б=т 
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ЕЗ Quantum FOURIER Transform on Groups 


Definition F.51 Let 5 be a finite abelian group and G its dual group. More- 
over, let H be a HILBERT space with dimH = |9| that has an ONB {|g;) | j € 
Т, Is such that we can identify each element g; of S with a basis 
vector of that ONB, and that the same holds for another ONB { |х) | ke 


{1,...,|G|}} of H and the elements |7,) of G, that is, 


H = Ѕрап{|81),...,[81))} = Span (lgj) | g; € S} 
—Span([xi)....ls)) = Ѕрап{ д) | x€} (Е106) 
(8120) = Sj = (ХХ): 


Then the quantum FOURIER transform on the group G is the operator Fe : 
H — H defined by 


1 
Fg := —— У x(8)lx)(el- (Е.107) 
[S| 869 
KES 


Exercise F.136 Show that the quantum FOURIER transform Fg is unitary. 


For a solution see Solution F.136 


The quantum FOURIER transform introduced in Definition 5.48 is a special case of 
the quantum FOURIER transform on groups, namely for the group Zon. 


Example F52 Consider the group б = Zy of Example F.29 for the special case 
N — 2" in which case 


$ = Z» LL { daz | x € {0,...,2"—1}} 
(F.46) 
8 p 9 — U(1) 
[x] 


- 0 [yet zn] 


n — е 
(Е.59) ee 

and |G| = 2” = ISI. Moreover, we can take H = ‘H®”, where H 2 C? is the qubit 
HILBERT space defined in Definition 2.28. If we assume that the identification of 
(F.106) can be written in the form 


| [X]anz) = |x) V [lanz € Топ 
у = |у) УХ, € Топ ; 
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then Fz,, of (F.107) becomes 


2^—1 


xy 
Fz, => ex (227) х)(у|, 
Zo A p 27i»; ) [007 


which is exactly as it was defined in Definition 5.48. 


F.4 Elliptic Curves 


Before we can define elliptic curves, we need to introduce the notion of a field. 


Definition F.53 А field is a set F together with an operation + : F x F — F 
called addition and an operation - : F x F — F called multiplication such that 


(i) (Е, +) is an abelian group with neutral element ep 
Gi) (Е {е+ь},-) is an abelian group 
Gii) multiplication is distributive over addition, that is, for all a,b,c € F we 
have 
a: (b+c)=a-b+a-c. 


Usually, the neutral element of addition е. is denoted by 0 and the neutral 
element of multiplication by 1. If the set F is finite the field is called finite as 
well. 


Example F.54 The definition of a field formalizes something we are most familiar 
with since О, R and C are all fields. But Z is not a field since any integer other than 
+1 has no integer multiplicative inverse. 


Corollary F.55 For a prime р 
Е, :=Z/pZ= Zp 


is a finite field. 


Appendix F: Some Group Theory 601 


Proof Lemma Е.5 states that Z, forms a group under addition and that Z; forms а 
multiplication group. Moreover, for any [a], , [b]; [¢lpz € Zp we have 


[a] л, ‘Zp ( [b] pz TE [],2) Es (a((b +c) mod p) ) mod p 
(F.11),(F.12) 
= ((ab) mod p+ (ac) mod p) mod p 


Кр 
(D.21),(D.23) 


N ар / la] „z "Zp [р] ,z Tz, [al z ‘Zp [c] pz ? 
(F.11),(F.12) 


showing that multiplication is distributive over addition and thus completing the 
proof that F, is a field. From Example F.7 and (F.46) we know that Z, is finite. 


Definition Е56 A (non-singular) elliptic curve with point at infinity Og over 
a field F is defined by two elements A,B € F as the set 


2 3 
= х +Ax+ B, where A,B € F 
ж bufoe}. 


е teo ЄЕХЕ V such that 44? +27825 Op 


The cubic equation y? = x? + Ax +B is called the WEIERSTRASS equation 
of the elliptic curve. The quantity 


Ag := 4A? + 27В? (F.108) 


is called the discriminant of the elliptic curve. 


In this definition any addition, multiplication and equality are all understood to be 
in the underlying field F. We shall also use the notation 1 to denote the multiplicative 
inverse of x € F. 

Strictly speaking—and as the noun ‘curve’ suggests—an elliptic curve is just 
the graph (x, y) € E(F)Ē {Ок} of the solutions of the WEIERSTRASS equation. We 
have added the point at infinity Og to this set because we want to make the elliptic 
curve into a group, and for this purpose, the point at infinity will serve as the neutral 
element of the group. 

Note that the elements of E(F) ~ {05 } come in pairs, that is, if (x, y) € E(IF) « 
(Oz) then it follows that (x, —y) € E(F) « (Og). This is often stated as the elliptic 
curve being symmetrical around the x-axis, which is evident in two-dimensional 
plots for the case IF = К. 


Example F.57 As an example we consider the case IF = R and A = —2 and B — 2. 
Figure F.1 then shows the curve E(R) \ {0g}. 
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Fig. F.1 Elliptic Curve over R with A = —2 and B = 2. The symmetry around the x-axis is evident 


The case F = R is special in that it allows to display the solutions (x,y) € R? of 
the WEIERSTRASS equation as an actual curve in the two-dimensional plane. For 
most other fields F no such graphical illustration or only a much less intuitive one 
is possible. 


The condition Ag Z Or is what makes the elliptic curve non-singular. To see its 
relevance, we first note that if the roots r1,r2,r3 € IF of the cubic on the right side of 
the WEIERSTRASS equation exist, we obtain 


x! Ax 4-B = (x— r)(x— r3) (x — r3) 
= (ri ra ra) + (түгә -Е rira + rar3)x — rir2ra, 


which implies 


гу d r2 ra = 0 (F.109) 
TjF?--rjra-cror4— A (F.110) 
—rjrora- B. (F.111) 


Exercise F.137 Show that the roots г, гә and r3 of the right side of the WEIER- 
STRASS equation and the discriminant Ag of an elliptic curve E satisfy 


(п-т) (т =) (о =) = —Ак. (E.112) 
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For a solution see Solution F.137 


From (F.112) we see that the requirement Ag Z Ок in Definition F.56 ensures that 
all roots of the cubic on the right side of the WEIERSTRASS equation are distinct. 
This is the only case which is of interest to us. 
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Fig. F.2 Graphical 
illustration of the addition of / 
P to itself in E(R) with P 
A — —2 and B — 2. The line ^ 

at P is the tangent to the 
curve. The intersection of 
this line with the curve is 
—2P. Reflecting this point 
about the x-axis gives 
2P—P-gP 


Proof Our first task is to show that P +g О € E(F). From (E.113) and (Е.114) we 
see that this is indeed the case when P = Og or О = Og since we assume P,Q € E(F) 
to begin with. Likewise, since Og € E(F), it follows from (F.115) that in the case 
P,Q € E(F)Ē {Ок}, where xp = xg and yp = —yg, we have P +g Q € E(F). 

Next, we show that in the case P,Q € E(F) \ {Og}, where xp = xg and yp = 
yo # Or or xp Z хо, we have P+, О € E(F). For this we need to show that (x, y+) 
as defined in (F.117) satisfies the WEIERSTRASS equation given that (xp,yp) and 
(хо,уо) do. To verify this, let m = m(P,Q) € F be as given in (F.116), and define 
the ‘line’ Pon " 

an =} 
deccm E ee (F.118) 


Then we have ур = l (xp) and yg = [(хо) as well as 


уһ =, l). 
(F117) (F118) 


Moreover, any pair (x,/(x)) that satisfies the WEIERSTRASS equation is by defini- 
tion an element of E(T), that is, 


(xx) EEF) e (9)! =л%+Ах+В. 


Hence, the point P +g О = (х,у) is the reflection about the x-axis of the intercep- 
tion of the line (x, /(x)) with the curve E(F) \ {Og}. We illustrate this graphically 
for E(IR) in the case where Р = О in Fig. F.2 and where P  Q in Fig. F.3. 
Consequently, if we show that (x+, 1 (x4.)) satisfies the WEIERSTRASS equation, 
then if follows that 


P+gQ= (хъ,у+) = (x4, -1(x4)) € E(F). 
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Fig. ЕЗ Graphical 
illustration of the calculation / 
of P+, Q in E(R) with / 
A = —2 апа В = 2. The 

intersection of the line EE Q) P 
through P and О with the 
curve is —(P +g О). 
Reflecting this point about 
the x-axis gives P +g О 


d/ 
49------- 
© 


If xp = хо and yp = yg 5 Og we show this by direct, albeit cumbersome, calculation. 
In this case we have 


3x2 +A 
msn (E.119) 
2yp 
x, = m?-—2xp (Е.120) 
and thus 
E cTAÀAx.4B— (14)? s 3m? x2 + Am? + 6mxpyp — 2m? yp — 9x — 3Axp 
(F.120) 
3x5 +A 320A 
_ 22Xp з ц Р 
2 | 2yp m + 3xp( Jyp )| 
= 0. 
(Е119) 
Now consider the case хр # xg. The expression 
x 4Ax+B-— (х)? (Е.121) 


= х? m4 (2т2хр — 2myp + А)х+ В — mx? + 2mxpyp — y 


is a cubic of which we already know two roots, namely хр and хо since 

P = (xp, yp = l(xp)) and О = (хо,уо = l(xg)) are both in E(F). Let x} denote 

the third root such that 

x Ax B-— (69)? = (x—xp)(x— xg)(x —x4) (Е.122) 
= х? — (xp -- xg + x4) + (хрхо -- XpX4. - XgX4.)Xx — Хрхох+. 


Comparing coefficients of x in (F121) and (F122), yields, after some 
re-arrangements, 
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Fig. A Illustration of the 
associativity of addition for 
E(IR) with A — —2 and 

B — 2. Here P is added to Q 
first, and the result is added 
to R, resulting in 

(P--gQ) += 


x, = m^ —xp—xg (Е.123) 
0 = 2myp — A— 2x? — XpXQ — хрх+ + Ххох+ (Е.124) 
0 = (2myp A 2x2 XpXQ — XpX+ T xQx4)xp, (Е.125) 


and we see that (F.123) gives х+ as claimed in (F.117). As for the other two equa- 
tions, suppose first that xp = 0. Then (F.125) is trivially satisfied and only (F.124) 
remains. Likewise, if xp 4 0, division by xp in (F.125) reduces it to (F.124). Using 
(F.123) in (E.124) and re-arranging it, we find 


т? (xo — xp)? + 2тур(хо —xp) = (x2 +% +xpxg + A) (xg — xp) 
= Xx) -FAxg — (xà + Axp) 
-5-J» (F.126) 


where in the last equation we used that (xp, yp) and (хо,уо) satisfy the WEIER- 
STRASS equation. From (F.126) we find that 


m= VLP 
ХО — XP 


is one solution for m which guarantees that (x.., y.) satisfies the WEIERSTRASS 
equation, and this completes the proof that P +z Q € E(F). 

To show that (E(IF), +g) is indeed a group, we also need to prove associativity 
of the addition. This can be done by direct computation as well, but is a very cum- 
bersome and tedious calculation, which we do not present here. Instead, we provide 
a graphical illustration of the associativity of addition in Figs. E.A and E.5. In the 
former we display the graphical calculation of (P +g О) +g R, whereas in the latter 
we show the calculation of P +g (Q +g К). 

Comparing the resulting point (Р +E 0) +e R in Fig. РА with that of P +g (о +E 
R) in Fig. F.5, shows that they are indeed identical, which provides a graphical 
‘proof’ of 
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Fig. F.5 Illustration of the 
associativity of addition for 
E(IR) with A — —2 and 

B — 2. Here Q is added to R 
first, and the result is added 
to P, resulting in 

Pg (Q--g К) 


(P+r О) +eR=P+eE (Q+ER). 


It remains to show the statements about the neutral element and inverses. From 
(F.113) and (F.114) we see that Og is the neutral element of +g, and from (F.115) 
we see that every element P = (х,у) € E(F) « (Og) has its inverse given by 


-ЕР = —к(х,у) = (х,—ку). 


Finally, we note that in (F.116) we have m(P, О) = m(Q, P), making +g commuta- 
tive and the group abelian. 


Corollary F.59 Let p be prime and F, = Z/pZ. Then the elliptic curve 
(E(Fp), +e) is a finite abelian group. 


Proof From Corollary F.55 we know that F, is a finite field, and from Theorem F.58 
it follows that (E(F,), +z) is then a finite abelian group. 


Example F.60 For finite fields F, the set E(F,) \ {Og} is no longer given by a 
curve, but rather a set of points. Moreover, the pairs ЕР € E(F,) \ (Og) are given 
by the solution pairs (x,+y,y) € Fp x F, of the WEIERSTRASS equation, where 
it follows from (E.13) that -g,y = p—y for y € (0,...,p — 1}. This results in the 
symmetry of the set about the line p/2. Figure F.6 shows the elliptic curve E(F,) 
for p — 541. 
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Fig. F6 Elliptic curve Е (Ед) over the finite field Е = Еду with A = —2 and В = 2. The sym- 
metry is made more evident by displaying a ‘symmetry axis’. It arises due to the fact that if (x,y) 
is a solution of the WEIERSTRASS equation, then so is — g(x,y) = (x, ву) = (x,541 — у) 


Е5 The PAULI Group 


Exercise F.138 Let o; for j € {1,2,3} denote the PAULI matrices defined in (2.74) 
and let оо :— 1 be the unit 2 x 2 matrix. Show that then the set 


P = {iOa | a, a € {0,...,3}} C Mat(2 x 2,C) 
forms a subgroup of U(2) = U(*H) with |P| = 16. 


For a solution see Solution F.138 


By selecting a basis in “Н, we can identify each matrix in Mat(2 x 2, C) bijectively 
with an element іп L(*H) such that Mat(2 x 2, C) = L(‘H) and, likewise, U(2) = 
W(*H). Hence, we will consider the elements of the set P as operators in UH) C 
L(‘H). 

Recall that throughout this book we use the notations 


00—1, 01—0,—X, M=O,=Y, 03=0,=Z 


to denote PAULI matrices. 
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The PAULI group F is clearly non-abelian. The only elements commuting with 
every other element, that is, the center Ctr(?) of the group (see Definition F.17) are 
powers of 11. 


Exercise F.139 Show that 
P = (Ox, Oy, Oz) (Е.127) 


апа 
Ctr(P) = (100) = (1) = {191 | ає {0,...,3}} (Е.128) 


such that | Ctr(P)| = 4. 


For a solution see Solution F.139 
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(iv) 
Сүг(Ф„) = (11°”) (Е.132) 


(v) 


LA = 22п+2 Я 


Proof First, we show that Ф, forms а group. Obviously, 1°"g = g = g1*" for апу 
g € P, such that 18” is the neutral element. Let 


g —i"Oe, , G0 Oa and h—i^og, , 69805, 


such that 
gh = ift Oa, 0g Q 9 Gay Op, « 


We know from Exercise F.138 that 05,05, = ioy, € P with cj, y; € {0,...,3). 
Using that if = 11" for any d € Z, we thus obtain 


gh= CELA, cj)mod4 


Oy, ,9: 904 E Pr, 

showing that the product of two elements of P, is again in P,. That every element 
of P, has an inverse follows from (F.131), which we show below. Assuming this, we 
have thus shown that Ф, C L(*IH?") forms a group, and we proceed with showing 
the claimed properties. 


(i) With g = 1400, | ®---® Cœ, we have 


* e * 
g = 180060, 


where we can use i^ = (—i)^ and O5, = Са; for all a, a; € {0,...,3} to obtain 
| g  ifae {0,2} 
* = (—1)00, 1 8-909 = = +в. 
8 = Cos, e i ifac {1,3} е 


(ii) For any 0; Є {0,...,3}, we have са, = 1 and thus 


1? іғає {0,2} 


E19", 
-19" іғає {1,3} 


g = габ, Q9 од, = (—1)°1®" = | 


Gii) 


-g ifac {1,3} “— 


: E iface(02) _ yon 
(Е.130) 


EEZ 
(Е.129) 
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(iv) Leth =i? Op, , D 8 0g, € Ctr(P,,). Per Definition F.17, this is equivalent to 
hg = gh for all g = i^oo, , ®---® бо € Pn. Consequently, 


08,0a; = бобр, Va; € (0,...,3],] € {0,... 0—1}, 


which means og, € Ctr(P) for every j and thus 
CHP = (Си(?))®" = ay = i19”). 
(F.128) 


(v) In an arbitrary g = 1400, , Q: 9 бо, € Pn, there аге 4 distinct elements бо, 
with a; € (0,...,3) possible in each tensor factor j Є (0,...,n — 1} and 4 
overall scalar pre-factors i^ € {+1,+i}. This gives rise to altogether 4"*! = 
22п+2 possible distinct elements in P,,. 


Definition F.63 The group 


Quim [1705-0990 ELH") |a ae {0,...,3}} < UH") 
is called the n-fold PAULI group. 


The weight wp of an element i05, , ®--- 9 Oœ € Pn is defined as the 
number of tensor factors j for which Og, 7 1, namely 


Wy(i^os, 19: 900) := | B € {0,...,2—1}| a; 40}| € No. (F133) 


Example F.64 For 


21—50;00;9091€734 and g2 =0:8918 0; € P3 


we have 
Wy(g1) =2 = мр(82), 


whereas for 


һу = Оо, 890890 Q0EP4 and M = 0 8 Ox 8 Or Q Oy € P4 


we find 


wọ(hı) =4= wọ(h2). 


612 Appendix F: Some Group Theory 


Before we continue to explore the structure of the PAULI group, we collect a few 
properties of the weight function wọ. 


Lemma Е65 The weight function wp : Pa — No satisfies 


walg) 20 = g € Ctr(?,) (F.134) 
wo(g !) = we(g*) = we(g) (F.135) 
wo(gh) € wp(g)+we(h). (F.136) 


Proof Let g = 1400, 9-9 O% € Pn. Since wp(g) = 0 if and only if og, = 1 for 
all j € (0,...,n — 1}, the claim in (F.134) follows from (F.132). 
From (Е131) we have g^! = g* and thus wp(g7!) = wp(g*). Moreover, since 


* mmi * TA Lk * rp» 
8 = (i Oo, 8:8 Goo) Z foana B+ @ Ogg = 100,100, 


(2.32), (3.31) (2.74) 


the number of j for which a; # 0 is the same for g* and g, and it follows that 


wo(g") = wo(s). 
To prove (F.136), leth=i?og | ®---® Op, € Pn such that 


— jab cde 
gh — 1 Oo, ,0pg, , 9: 9 бобр, —8-—1 Суу 9 © бу, 


and observe that 


{7Є{0,...,п—1}|у; 50} 
= {je {0,...,n—1}| aj z Bj) 
C {je {0,...,..—1}| a; Z0] uU (j e (0,...,n—1)| B; 20) 


and therefore 


wy (gh) en. эл-1}|уу 0}| 
(Е.133) 
< |{/е{0%.ул-1}|оу40}|+|{/є {0,...,л—1}| 8) 4 0}| 
= мок) +wo(h). 


=> 
e 
— 
ies) 
Uo 
= 
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Proof To show (F.138), we use that 07, = бе, for any œ € {0,...,3} to obtain 


Zala)" = (oz e.-eop) = (ox) 9-8 (od) —ov 8 @ og? 
(Е.137) (3.31) 
er Xa (a). 
(F.137) 
To show (F.139), we use that 02 = 1 for any о € {0,...,3} such that og’ oy = 
2 
g4 and thus 
Za(a)Za(b) (со! ®---® се) (се! 9--- 9000) 
b, 
oto by-1 D- 902 ob = = = gine ni g.. зот 
_ 
Eala © b). 


Lastly, we have 
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an—|1 


У, (а)х, (Б) =, (oi @--- og) (o? &--- oh) 


2 
(Е.137) 


ап—1 


- bn-1 a bi ао Abo 
= Oy Oz" 9.90010: ®@ o о; 


DN EE 
= (-1) of" 07"! 9... Bota?! eleg? 


n—1 
= (—1)2i-0% Jo," on 1@.--@ obo gto 


2 
=, C0) x (b)x, (a), 
(F.137) 


proving (F.140). 


Example Е67 For п = 3 we have, for example, 


1 1 
Z0] =0,@1@0, and £ |1] =0,©0,80, 
1 1 


such that 


1 
Xx {O] 2,4 1 = 0,0; ® 0; ® 0,0; = (—id)) ® 0: Q (—ioy) = —0, 8 0, 6 Oz. 
1 


Lemma F.68 Let n € N and >, and X, be as defined in Lemma F.66. Then 
any g € P, can be written in the form 


g 2i €, (х(е))Х,(2(8)), (K.141) 


where c(g) € {0,...,3} and x(g),z(g) € F5 are uniquely determined Бу g. 


Proof From Definition F.63 of P, we know that any g € 7, is of the form 
g= Oo, Q0 Oa 
with a, œ; € {0,...,3}. On the other hand, 


iX. (x)2.(z) = ior? Q-Q o?) (or^ Q9 o2) 


a 


Хр n= Y 
=i'o,” 0," @ + motos, 


where for any j € {0,...,n—1} 
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00 ifxj-0-zj 
Kee Ox if x; = landz;j— 0 
Oy Oz = , 
Oz ifx;=0andzj= 1 
—10, ifx;=1=z;. 


This shows that with a suitable choice of с = c(g),x = x(g),z = z(g) we obtain 


and have shown (F.141). 
Suppose now there are C, X, Z such that 


ge fX&)Xx.(z) 


as well. Then we have 


Sut (=i) X (z) E (x) 
(F.138) 


such that 


18" =, gg = i (—i) X (2), (X) X (х). (2) 
(Е.131) 


д = Ж Ж 
=, GE SHE) = к %(—1)%®%#у(х фуу, (д) 


Ww 
(F.139) (E.140) 
зә 2 2- 2. _ 2 
uif F-08999: 63)z (1 Өх). 
(Е.139) 


This requires А Я 
х, (x Ф х) = 1®" = Eze z) 


and thus А ó 
X@Ox=0=20z2. 

2 m x " 25 Di 
Since x, X, z,z € ЕЗ, it follows that X = x and 7 = z as well as (—1) 9*7 = 1. Thus, 
we are left with _ 

18^ E g'g = 1-1%" А 

and since c, € {0,...,3}, we must have с = С, which completes the proof of the 
uniqueness of c = c(g),x = x(g) and z = z(g). 
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Definition F.69 Let n є N. The mappings 


(c(),xC),z(-)) : Py» — Fa x F} x F3 
g > (c(g),x(g),2(g)) 


are defined by means of the unique representation of g as 


g =i) X, (x(g)) Z;(z(g)). (F.142) 


Exercise F.140 Let c(-),x(-) and z(-) be as defined in Definition F.69. Show that 
then for any g,h € Pn 


c(gh) = (c(g) + c(h) + 22(g) 6 x(h)) mod4 (F.143) 
x(gh) = x(g) @x(h) (Е144) 
woh) = ale) Ән): (F.145) 


For a solution see Solution F.140 


Proposition F.70 For any g,h € P„ we have 


gh (1) 660929) (0050) p 
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Lemma Е71 Let m,n € N with m < n and {g1,...,8m} € Ф, such that 
—1?" d (g1,..., gu). Then we have 


(21,..., n] are independent 


Е C | eu т) C IF?" are linearly independent. 
1 


Proof Let (g1,...,g&] € Pn be such that 19" ¢ (g1,..., 2m). We show the claim 
by contraposition. Let the { es | le (1,... т) С po be linearly dependent 
І 


such that there exist К,...,К„ € F2 with some К; = 1 and 


: ‚| (о) 2 
k mod2 — є F5. F.146 
2 ipe 0 2 ( ) 
This implies that 
k k у 2 т 
x(gj en) = kix(gi) © © kmX(8m) = У, kx(gi) mod2, = 0 
(F.144) 1=1 (F.146) 
К (F.147) 
kı km 2 E 2 m = 
2081580") = kiz(81) Ө: © kmZ(8m) = Y, az(gi) mod2, — 0, 
(Е.145) 1=1 (F.146) 
and thus, 
k km = 1 pia km k Кт К Кт 
gigi = irm my (x(ght--- gl), (2(gi! -- pln) 
(K.142) 
jelsi e) jc e) yon 
Log my (0) у, (0) = i emen. (F.148) 
(K.147) 


We know from (F.130) that any g € P, satisfies g? = +18”. Since — 1?" ¢ (g1,...,2m), 


it follows that 
g —19" Vg (g1,...,8m)- (Е.149) 


Hence, for any k;,..., k, € F2 we must have (gf! . gh)? = 1%”, and (Е.148) then 
implies that cgt 50") = 0. By our initial assumption, we have k; = 1 for some j 
and thus 
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deg 
2 т—1 __ 1 Gk, 
>, 81 Es = By 8w 
(F.149) 
ki- k k; 

i ——35 J 1 + 1 k, n itl 
„=, 8) = 8j-1 U 81 8m 81: 
(F.149) 


Hence, the {g1 . . . , 2m} are not independent. We have thus shown that 


{ B | le {1, В т) C F2" are linearly dependent 
1 


=> {g1,...,2m} are not independent. 


The claim of the lemma then follows by contraposition. 


With the previous lemma we can derive the following proposition, which is useful 
in the context of the stabilizer formalism in quantum error correction in Sect. 7.3.3. 


Proposition E72 Let m,n € N with m < n and let (g1,...,g&) € Pn be inde- 
pendent and satisfy —19" ¢ (g1,..., gy). Then for any j € {1,...,m} there 
exists an h € Ф, such that 


gih=(—1)%hg, vl e (1,...,m). (F.150) 


Proof From Proposition F.70 we know that for any g,h € P, 


2 


gh = (1) FON) (0050) p 


For A to satisfy (F.150), it is thus necessary and sufficient that for all j,/ € {1,...,m} 


(x(g1) © a(h))  (z(g)) © x(h)) = бу, 


which is equivalent to the matrix equation 


x Т 7 Т ; 
E s E Е 2 | (Е.151) 
_ X(gm)^ z(gm)* бл} 


—MeMat(mx2n,F») 
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Since the (21,...,g,,) are independent, we know from Lemma E71 that then the 
{ Bo | le (1,... т) are linearly independent. Consequently, ће matrix М 
1 


іп (F.151) is of maximal rank т and we can always find a solution for z(h) and x(h) 
in (E.151). With this solution 


h= X, (x(h)) х, (z(h)) € Pn 


has the desired property (F.150). 


It turns out that for a subgroup of the PAULI group that does not contain — 1?" 
its normalizer and centralizer coincide. This is to be shown in Exercise F.141. 


Exercise Е.141 Let $ be a subgroup of Ф, that satisfies — 19" ¢ 8. Show that then 
Norp, (8) = Clzp, (8). 


For a solution see Solution F.141. 


Appendix G 
Proof of a Quantum Adiabatic Theorem 


G.1 Resolvents and Projections 


A first ingredient required for our proof of the Quantum Adiabatic Theorem is the 
resolvent of an operator. 


Definition G.1 The resolvent of an operator A on a HILBERT space H is 


defined as 
R (4) 2 (C ss с(А) — L(H) 


Z — R (A) := (4-21) | Ken 


Recall from Definition 2.10 that the operator R,(A) does indeed exist for z Є 
СУ c (A). Moreover, it is obvious from (G.1) that, by definition, 


R,(4A) ! 2A- zd. 


Exercise G.142 Let A € Bsa(H) with purely discrete (and possibly degenerate) 
spectrum o(A) = {A;| j € I C No}, and let P; denote the projections onto the cor- 
responding eigenspaces. Show that №, (A) can be written as 


P; 
R(A) = У ——. (G.2) 
jel Aj-z 
For a solution see Solution G.142. 
© Springer Nature Switzerland AG 2019 621 
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The resolvent is an operator valued analytical function of z € C \ o (A) in the sense 
of complex analysis. We will not prove this fact here, but will make use of it when 
writing the projection onto eigenspaces with the help of the resolvent. 


Lemma G.2 Let A € B,4(H) with purely discrete (and possibly degenerate) 
spectrum O(A) = {21| l € I C No} and with resolvent R,.)(A). For any j € I 
let y; be any closed counter-clockwise curve in C x~ o (A) that encloses solely 
the eigenvalue Àj from o (A). Then the projection P; onto the eigenspace of 
A; satisfies 

ү j Hus (G.3) 


2л1 Yj 


Proof Using (G.2) in the right side of (G.3), gives for any j € I 


(aps ee 


kel 


= (G.4) 


2ni Jy, z— fdz 
Here we can use the operator version of the CAUCHY Theorem from complex anal- 
ysis, which tells us that for a function f : C — C that is analytic on and inside a 
curve % which encloses zo € C counter-clockwise one has for any n € No 


n! { f(z) Е {з f(zo) if yo encloses zo (G.5) 


25i Ду» (z —zo)^*! 0 else. 


Applying this to the right side of (G.4) gives 


1 { P, d P, if yj encloses Ax 
2ni Jy, z — № 0 else 


= Р; 


since, by assumption, y; only encloses the eigenvalue Àj. Inserting this into (G.4) 
yields the claim (G.3). 


The following transformation, which is defined using the resolvent of operator- 
valued functions s — Ну () satisfying the Adiabatic Assumption (AA), will be very 
useful for obtaining bounds on various operators in the context of the proof of the 
adiabatic theorem. 


Appendix О: Proof of a Quantum Adiabatic Theorem 623 


Definition G.3 Let H be a HILBERT space and let H7 be an operator-valued 


function 
Нт: [0,1] — Bsa(H) 
s + Hr(s) 


satisfying the Adiabatic Assumption (AA). Moreover, let y;(s) be any closed 
counter-clockwise curve in Cx o(Hr(s)) that encloses solely the eigenvalue 
Ej(s) from o(Hr(s)). For any 


and j € / we define 


by 
Х ДАЈ) := Е 2 f T R.(Hr(s)) A(s) R (Hr (s))az. (G.6) 


We shall see later that the X;[A](s) do not depend on the exact form of the curves 
y;(s) as long as these are of the form described in Definition G.3. We will also show 
later that X;[A](s) c B(H). 


Exercise G.143 Show that 
d : 
qe R(Hr(G)) = —R(Hr(s)) Hr(s)R-(Hr(s)) . (G.7) 


For a solution see Solution G.143. 


Definition G.4 Let H7 : [0,1] — Bsa(H) be an operator-valued function sat- 
isfying the Adiabatic Assumption (AA). The gap (or the gap function) of 
the eigenvalue E;(s) of Hr (s) is defined as 


s gi): mnf|&()-E()|| кє tp}. 09 
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Lemma G.5 Let Hr : [0,1] — Bsa(H) be such that it satisfies the Adia- 
batic Assumption (AA) and let {P;(s)| j € I) denote the projections onto the 
eigenspaces of Нт (s). Then we have for all j € I and s € [0,1] 


PX [Hr] (s) (G.9) 


and 
[Hr (s), X; [> (s)] = —[Bj(5), P;(s)] . (G.10) 


Proof From (G.3) it follows that 


Pi(s) nm f (нт), 


where we choose the curves y;(s) to be circles with radius r — ge centered at 


Ej(s). We then have 


: —14 
1 


) 
sai ma (f, Anais fo R Hn) 


-l,. 1 d 
= эл; (ўы [R: (Hr (5)) + 3, R(HrG))as + о(а5°)]ас 


J 


- f  Re(Hr(s)) dz) 


-lp, 1 
= zzi | im = ( f и f, „к нт®)®) 


$ 


d 
Ho —R.(Hr(s)) 42]. (6.11) 


In (G.11) the limit term comprised of ће difference of the integrals along the curves 
yj(s+ds) and y;(s) vanishes. This is because item (iii) in the Adiabatic Assumption 
(AA) implies that each eigenvalue E;(s) of Hr(s) is separated by a finite non-zero 
distance g;(s) = 2r from all other eigenvalues. Hence, for small enough ds, the only 
singularity of the function z — R;(Hr(s)) inside the circle y;(s+ds) will be at 
zo = Ej(s) making the integrals of R; (Hz (s)) along the two curves y;(s+ds) and 
y;(s) equal. Consequently, (G.11) becomes 
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which proves (G.9). 
To show (G.10), note that the definition of X;|-] in (G.6) implies 


н х2 09) = HO: a f. Re(Hr(9)) 9 (не) 


= mfo [Hr (s), R (Hr (s))P;(s)R:(Hr(s))dz] 
= ae (Hr (5). (Hr(s))Pj(s)R-(Hr(s)) (G.12) 
— R: (Hr (s))P;(s)R:(Hr (5) Но (s) ) dz, 


and that by Definition G.142 R, (Hr (s)) satisfies 


such that 


Hr(s)R:(Hr(s)) = 1-28. (Hr (s)) = R-(Hr(s))H7(s). 
Using this in (G.12), we obtain 


[HrG).X; [5|] = xi f o (rrt H0) e n) 


= к. (Нг (5) Bs) (1+ cR (Hrs) Jaz 


E xi ў (205) к. (Н (в) = к. (Hr (5) 605) )а 


um [Pi(s),Pi(s)] , 
(G3) 


which completes the proof of (G.10). 
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Let us collect a few more properties of the projections {P;(s)| j € I}, which we 
will need in various proofs later on. 


Lemma G.6 Let Hr : [0,1] > Bsa(H) be such that it satisfies the Adiabatic 
Assumption (AA) and let {E;(s) | j € I} denote the eigenvalues of Hr(s) 
each of which may be dj-fold degenerate. Moreover, let (|o; o (s)) | JElLae 
{1,...,d;}} denote the ONB of eigenvectors of Hr(s) and let {P;(s)| j € I} 
denote the projections onto its eigenspaces. 

Then these projections satisfy for all j,k € I and s € [0,1] 


dj 
2 ІФ; als)) (D; «(5)| = Pj(s) (G.13) 
P;(s)P;(s) + Pj(s)Pj(s) = Pj(s) (G.14) 
P,(s)P;(s )Р.(5) = 0 (G.15) 
DE (G.16) 
jel 


Proof The claim (G.13) is a direct consequence of (2.41) and the fact that 
{|Pj,«(s)) | j€1,a€ {1,...,dj}} is by assumption an ONB of eigenvectors of 
Hr(s) for each s є [0, 1]. 

The P;(s) are orthogonal projections for every j Є J and s € [0, 1]. Hence, (2.44) 
implies (P;(s))” = P;(s). Taking the derivative with respect to s on both sides of this 
equation yields (G.14). 

Multiplying both sides of (G.14) from left and right with Р, (з), we obtain 


PG) Pj) PG) Р, (5) (Р;(5) Pj(5) + Pj(s)Pi(s)) Pis) 


ape 
(G.14) 


= Ю(5)Ру(у yaks )Pe(s) + Pe(s)P;(s)P;(s)Pe(s) 
= —=,‚2биР\(5 )Pj(s)k(s) ; 


m 44) 


which implies (G.15). 

Finally, (2.43) implies that for all s € [0, 1] we have У ;<; P;(s) = 1. Once again, 
taking the derivative with respect to s on both sides of this equation yields the claim 
(G.16) 
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G.2 Adiabatic Generator and Intertwiner 


Definition G.7 Let H7 be as defined in Definition 8.1 and such that it satisfies 
the Adiabatic Assumption (AA), and let (P;(s) | j € I} be the projections onto 
the eigenspaces of Hr(s). For each j € J the adiabatic generator НА ; is 
defined as 


НА у: [0,1] — B,.(H) 


s — НА j(s) = THz (s) + i[P;(s),P;(s)] f (G.17) 


Гетта G.8 Let НА; be as defined in Definition G.7, and let {P;(s)| j € Г} 
be the projections onto the eigenspaces of Hr (s). Then we have for all j € I 
and s € [0,1] 

Ha, j(s)* = Ha,j(s) (G.18) 


and 


iP;(s) OMe (G.19) 


Proof From its its definition (8.4) we know already that Ну (5) is self-adjoint and 
thus the term THp (5) in (G.17) is as well. Hence, 


Hays — m, THC) + (iG) P G)]) 

(G.17) 

ano Thoil ERY 
2,32) 

52 ТН) -i(Fi(5)P)(5)) HPOO) 
2.46) 

= THr(s) —iPj(s)*Pj(s)* iB) Pj)" 
2.47) 

=, THr(s) ~iPi(s)Pi(s) + iPj(s)Pi(s) 

Def. 2.11, Exerc. 8.94 


which proves (G.18). 
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In order to prove (G.19), we observe that, by definition (G.17) of the adiabatic 
generator, we have 


[Ha,j(s),Pi(s)] = Т[нт(5),Ру(5)] +i[[Pi(s),Pi(s)] Р) |. (G.20) 


From (2.42) it follows that Hr(s) = Урс Ёк(5)Р; (5), which together with (2.44) 
implies that [H7(s),P;(s)] = 0, that is, Ну (з) commutes with all its orthogonal pro- 
jectors P;(s). Consequently, (G.20) becomes 


[Haj(s),P()] = — i[)G. 56.5) 
=, 1Р9) Рз) – РЗ) (8), Р(9)] 
(2.47) 
m 2 2 
= i(Fi(s)(Pi(s)) — 2P;(s)P;(s)Pj(s) + (Р(х) Bj(s)) 
(2.47) 
ano IOR) 
(2.44),(G.15) 
(G.14) 


which completes the proof of (G.19). 


Definition G.9 Let НА ; be as defined in Definition G.7. For each j € J the 
adiabatic intertwiner U4 ; : [0,1] — (Н) is defined as the solution of the 
initial value problem 


iUa, (s) = Ha,j(s)Ua,j(s) (G.21) 


As usual, we assume that the HA ;(s) are such that a solution exists and is unique. 


Exercise G.144 Show that the adiabatic intertwiners UA ; satisfy 


(G.22) 


For a solution see Solution G.144. 


The next lemma shows why the intertwiner has its name. 
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Lemma С.10 Let U4 j be defined as in Definition G.9 and P;(s) as in Defi- 
nition G.7. For any j € I and s € [0,1] we have 


Ua (s) Pj(s)UA,;(s) = P;(0) . (G.23) 


Proof Since ОА j(0) = 1 = U4, ;(0)*, the statement (G.23) is true for s = 0. To prove 
it for any s € [0, 1], it thus suffices to show that the left side of (G.23) is constant. 
For this expression we find 


4 (MSPO) = UGG" PIG GG) Un (S) Èl) (S) 


(G.21),(G.22) 


eS iUA j(s)* НУР )бл,)у(5) 


+ Ug, j(8)"Pj(s)Ua,j(s) 
— iUa (s) Pj(s)Ha.;(s a 5) 
= Ug, j(S) "(ёк 5) +1|НА, (5) Р\(5)]) Ол, ) 
x N 
(G.19) 


which completes the proof of (G.23). 


G.3 Reduced Resolvent, Bounds on Time Derivatives 
and an Adiabatic Theorem 


Definition G.11 Let A € Bsa(H) with purely discrete (and possibly degener- 
ate) spectrum o (A) = {A;| j € I C No}, and let (P;| j € I} denote the pro- 
jections onto its eigenspaces. For each j € I the reduced resolvent R j(A) is 
defined as 


йда) = (1-F)((A-Aal) lage) (1—Р) erm. 


where the rightmost factor 1 — P; on the right side is taken as the operator 
1— P; : H — P;{H}-, whereas the leftmost factor 1 — P; is to be understood 
as 1— P; : РН} — H. 
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Note that we can express А — À;1 with the help of projectors as 


А-А =, MÜ«-A)R- У, (An Aj) Pe (G.24) 


(2.42), (2.43) S! ker) 


Thus, the reduced resolvent Rj (A) operates non-trivially only in the orthogonal com- 
plement of the eigenspace for the eigenvalue А ;. The eigenspace is given by P;{H}, 
and its orthogonal complement is denoted by P;{H}~. 


Exercise G.145 Show that the reduced resolvent as defined in Definition G.11 sat- 
isfies 


v Р, 
Rj(A) = (6.25) 
| P = А 
РЁ (А) = 0 = Ё (А)Р; (6.26) 
(1-Р) (А) = Rj(A) = Rj(A)(1- Pj). (9.27) 


For a solution see Solution G.145. 


The inverse of the gap function defined in Definition G.4 bounds the norm of the 
reduced resolvent of H7 (5). 


Lemma G.12 Let Hr : [0,1] — B,«(H) be such that it satisfies the Adiabatic 
Assumption (AA). Then we have 


1 
gi(s) 


|Ri(Hr(s))|| € (G.28) 


Proof Let |Ҹ) € H. Then we have 


|; (Hr) 1) (Rj (Hr(s)) PIR; (Hr (в) У) 


=.» (Рев) |Р (5)\Р) 
bend (Ex(s) — Ej(s)) (Eis) — E;(s)) 


(G.25) kleIN{j} 
(P| Pi(s)Pi(s)?) 
ү} UG) — Ej()) (Eis) — Ej) 


ELS 
и 
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(P |PL(s)) 
= $ 
— ыл P Ei) (EN) EG) 


(2.44) 
_APIPE(S)) _ 
ker-(j) (Ex(s) — E;(s)) 


1 
< >. Fae). (G.29) 
p gj(s) kelN{j} 


Definition 2.11 of an orthogonal projection implies 


(P|P;(s)¥) = (Р|Р,()?\Р) = (iG) | Pj) P) 


(2.2 


мх 


Using this in (G.29) gives 


^ 


114 (Hr IP]? < : :( > О nno 


8308)? Мел 
1 
= Zap ент) = py MPO 
І Р]? 
= (РР) = 
ЧӨЙ уре? 


The claim (С.28) then follows from the definition (2.45) of the operator norm. 


Theorem G.13 Let Hr : [0,1] — Bsa(H) be such that it satisfies the Adiabatic 
Assumption (AA) and let 


A: [0,1] — Bsa(H) 
s — A(s) 


be differentiable with respect to s. Moreover, let ХА] be defined as in Defini- 
tion G.3. Then the following bounds hold. 


(ї) 


||X;[Al(s)|| < (С.30) 
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such that ХА]: [0,1] — B(H). 
(ii) 


| aol — [Hz] | cot 
= Ре | (G.31) 


&j(s) gj(sy 


Proof In order to simplify the notation in this proof, we shall omit writing out the 
s-dependence explicitly and use the following abbreviations 


Pj = P;(s) A=A(s) Ř;=Ř; Hr 5)) 
E; = Ej(s) yj = vi(s) ХА] = XjlAK(s) (G.32) 
Hr = Hr(s) Ha,j = Ha,;(s) gj = gj(s) 


Beginning with (1), we note that from the expression (G.2) for the resolvent and the 
Definition G.3 we obtain 


1 РАР, 
ХА] j dz. (G.33) 
/ >» 2л1 Yi (Ex — z)(E; — z) 


Here we use the CAUCHY-integral formula (G.5), which gives 


РАР, 


1 PAP Ej-Ei кш 
КАҢ, 
- dz—4 PAP; . s 
E em Е-Е, ifkz j=l 
0 else 

such that (G.33) becomes 

РАР, PAP; = 

Xj4]- У E + T = —(BjAR;-- RjAP;) . 
р 77 єг{ 7 СК, 


Note that PjAR у and R АР; map into orthogonal subspaces, that is, for any |Р) € H 
we have 


(PjAR V|R;AP;P) = (АЁАР|РЙЁ;АР\Р) = 


j 


0. 


ES 
M 


7 (G.26) 
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Consequently, we can apply (2.15) to obtain 


xar]? Z Ё)АРУР|| + ||P;AŘ Y|]? 
(2.15) 
s 2 " 2 
o ПААР |+ ||P ARP)? || 
sai 2 2 2 2 2 
= RAP AI? ПР +e ПАП Rall [| n — 0) #11 
—— 
(2.51),(2.52) M 
< 213 A РР —Р\ф J 
||; || - | c — ;) | 
(G.28) 


(G.34) 
Since РР and (1 = P;) Y belong to orthogonal subspaces, we can once again apply 
(2.15) to find that 
2 2 
РУР + ||@—Ру)Ф| = 11Р 


Hence, (G.34) becomes 


< lÉ 


Igar? <Ir, 


and the claim (G.30) follows from the definition (2.45) of the operator norm. In 
order to show (G.31) we first note that in taking the derivative with respect to s of 
X;[A](s) the same arguments as in the proof of Lemma G.5 apply, in other words, 
we can ignore the s-dependence of the curve y;(s) and take the s-derivative under 
the integral only to obtain 


&X|A] =, suf, (RAR: - RR RAR;)dz 
i (G.35) 
=, ХА] sls fj (RHrRAR, + AR HrR;)dz 
(G.6),(G.7) 


Consider the integral with the first term, which gives 


Pk | P; Pn 


i | 
s= ф, RB.HTR.IAR.dz, = H A d 
add — mh Уор, т Ez E. 7 
i LN ERU EI MN MU, 
А =:Сит (z) (G.36) 
= У Jri $y, Сит (z)dz Й 


k,l,mel 


where the CAUCHY integral formula (G.5) can be applied to yield 
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otn un ifk— jz lm 
g; HrP Mm ifl-jzkm 
jui j Сит(2) = AF i сите, : : 
Yi Ehe ык -AP; ifm=jÆk,l 
0 else. 
Inserting this into (G.36), we obtain 


1 | ты, | P; Pm 

+ 2 g Е;НТР, Ат ir 

kmelN{ j} di (G.37) 
Р, . 

+ | БЕ; Hr gg. -AP; 

k,leIN{j} 
PjHrRjAR ; + R;Hr PjAR + KjHr R;AP 
(G.25) 


Similarly, the second integral term in (G.35) yields 


2ni 


(G.38) 
With (G.37) and (G.38) the integral term in (G.35) becomes 


mi f, (R. Hr R;AR; + R/AR;HrR;)dz = Pj (HrRjA+AR Hr) 


K;(HrPjA -- AP;Hr) Rj 


Here we can use that (G.26) implies that P; and Ё j map into orthogonal subspaces 
such that we can apply (2.15) to obtain for any |W) € H 


z 2 
= | |P/(HrR;A +ARjHr) RV | 


1 


2 
m (R. Hr R.AR; + R-AR;HzR;)dz| P) 


(G.39) 
| к Dl A 2 
+ ||; ((HrPiA-- APjHz)R;-- (HrR;A - AR; Hr) Pj) | 


Appendix G: Proof of a Quantum Adiabatic Theorem 


In (G.39) the first term can be estimated as follows. 


2 
5 2 
Rill) IIl 


Hr A +AR Hr 


Y 242 2 
Ril?) П. 


The second term in (G.39) is estimated similarly. 
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(G.40) 


Exercise G.146 Show that 


Ri (( HrPjA - APÁHz) Rj + (Hr RjA -- AR;Hz)P. yell 


< (2 |н. иаи?) эү. 


For a solution see Solution G.146 


(G.41) 


Using (G.40) and (G.41) in (G.39), yields for any |У) € H 


1 
2ni 


f (R. Hr R;AR; +R-AR,HrR; ww) < (4| Hz 


which, together with Definition 2.12 of the operator norm, implies 


ДА 


э fy (R Hr RR, + RAR HR.) dz|| 


[rl 
Pull a | 


“MY 8} 


From this ара (G.35) it follows that 


£x < [HA] | 
(2.53) 
< ани! 
WH 8j 


(G.30),(G.42) 


completing the proof of (G.31). 


үүө, 


(С.42) 


(R: Hr R;AR; + R:AR;HzR;) dz | 
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Before we can finally formulate and prove our version of the Quantum Adiabatic 
Theorem, we need one more ingredient. 


Corollary G.14 Let Hr be as defined in Definition 8.1 and such that it satis- 
fies the Adiabatic Assumption (AA), and let {P;(s)| j € I} be the projections 
onto the eigenspaces of Hr (s). Then we have 


NE 


G.43 
809) о 


lo 
Proof From (G.9) in Lemma G.5 we know already that P; =X; 3 therefore, 
lua 


| Ж АШ 
Кр gj 
(G.9) (G.30) 


as claimed. 


We can now prove what we might call a precursor to the actual Quantum Adia- 
batic Theorem. A statement about the probability to find an eigenstate of Hg at tin, 
given that we started from a corresponding eigenstate of Hi at fini, will follow as a 
corollary from the following theorem. 


Theorem G.15 (Quantum Adiabatic Theorem [111]) Let Hr be as defined 
in Definition 8.1 and such that it satisfies the Adiabatic Assumption (AA), and 
let be {P,(s) | i € I} the projections onto the eigenspaces of Hr(s). For a given 
j € 1 let gj be its gap function as defined in Definition G.4. Moreover, let Ur 
and U4 j be as defined in Definitions 8.1 and G.9. 

Then we have for all j € I and s € |0, 1] 


Ол, (в) - Ur(s)) Pi(0)|| < um (G.44) 
where 
нео] [Heol] нө [reo] 
Cor ae: + gos ^ guy 1 0 455 du. 


0 
(G.45) 
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Proof Once again, for the sake of brevity we often omit writing out the s-dependence 
explicitly in this proof and abbreviate as shown in (G.32). We consider first 


d * 
as (Ua jUr) | 
— iU, ;H4,;Ur — iU; ,THrUT 
(G.22),(8.6) 


iU (На, = THr)Ur 


=, —UR [PAP ]Ur = Uh, [Hr.X)[P)]JUr 
(G.17) (G.10) 


ane Hs Рх 4 Ur 
Uj (На, -i[Bi P)]) X; [ДЕ Р Hr )Ur 


= UR Ha Xi [P]Ur — Ux ВРХ |P; |Ur — Us jx; [| Hr Ur 
2, FUR [2] 0418р [Py Ur - oz ps [Ps] Ит 


) 
= 2 ($ (ux x; (Р от) -01,(&Х) (Р). 
+0; [РьРДХ[РДИт ) 


Integrating both sides and using that Ол (0) = 1 = Ur (0), we find 
Ui (Urls) =1- 4 (ux x; [E] iur -x; [5] 0) 
- s [visa (гё) Р] [Aon ~ хо |2) ондаи. 

Consequently, we have 

ит) =й) — (Xj [E] our) - Us (9X; [A] (0)) 

= 005) f uiw (Геи) Pi] [2 – x5 [6] v) urn. 
0 

Making use of (2.53) and (2.54), it follows that 


[Ua (s) - Ur(s)]| 


< 1b [5] ur) оао [5] | mus 
с ол) ох (E60). уо] [Ps] o £ xÈ W Urdu 
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In (G.46) we estimate the two terms separately and begin with 


Ji )Ur(s) —UA (s) 


x, [Fijo 


Ur (s) || + | |Ua.,;(s) 


leol 
+o] 


f| 


‚|ҥ®| 


g;(0) 


Xj Ру |(5 
< Гр, 
e IE] 
(2.52),(2.53) 
S AN 
(2.55) 
91 
< + 
-—— gils) 
(6.30) 
|на) 
< | 
~~ ge? 
(G.43) 


G.47 
FOL uL 


The second term in (G.46) is estimated similarly 


US) / UA j) (во) Рид] [ё] uw) — 5x; 4] Urdu 
0 
Е / оз ju) (([Ру(и),Ру()]х;[Ё](н) — 7x fE; uo) Ur (ди 
(2.52) 0 
=F / оз (Ewro [Ej] un — x, О 
(2.55) 110 
= |е (Eoo et] [vo - zx [enu 
0 
E j U5. (w)|) (вш), Р] х2 и) — x; [B5] eo) ото) 1а 
2.52) 0 
=| [Pj(u),P;(w)]X; [Р (и) — x; [P5] o| du 
2.55) 0 
= | tee 3x; [5;] eo] | + xj [buo Jau. (G.48) 
2.53) 0 
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In the last equation of (G.48) we estimate the terms under the integral separately. 
The first term gives 


lgo gnwa] = leoleo] eleo 
(2.46),(2.52),(2.53) 
E On 
m e gj(u) 
« [reo] | G.49 
eal? Se 
The second term in (G.48) is estimated as follows 
PNE Pj(u Нг (и) ||Ру(и) 
46 X a MI Ule 
ии) |н) 
n gj(u) gj(u)? 
lelo] [no] 
Zo W “gW 
‚э (көй көгү Je 
том gj(u gj(u) gj(u) gj(u)? 
co], [poco 
sup 5 qup nos 


Using (G.49) and (G.50) in (G.48) gives 


RULES [ДО ж [Pi|(w)) Ur(wdu 


Jl s ll. MISI " с 
0 


gj(u 
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Making use of (G.47) and (G.51) in (G.46), we obtain 


0, (в) = О (в) [| 


< + 


АЛИШ И: 


(G.52) 


^T кў? ^ gy yi 7 


The claim (G.44) then follows from (G.52) and 


(06) - Ur) P|] <, 


— 
N 
л 
N 

кея 


_— 
(2.55) 


TN 


6 


||Ua. (s 


enl 
(ШЗ du 


830и 


) - ur(s)|| ||P;(0)|| 


)-ur(5)]]. 


Solutions to Exercises 


Solutions to Exercises from Chapter 2 


Solution 2.1 
(i) The claim (2.6) follows from 


ayle) = (play) = alely) = a(elv), = allo). 
(2.1) 


(2.4) (2.1) 
With ||| = (ọlọ) for all 9 € H it follows that 


2 = u 2 2 
Паф" = (афјаф) = а(аф|ф) = elo) = al lloll 


(2.5) (2.4) (2.6) (2.5) 
and thus upon taking the square root the claim (2.7). 


(ii) =: (w|@) =0 for all ф € H implies (y|y)=0, such that y=0 follows from (2.3). 
<=: Let y= 0 and €,@ € H be arbitrary. Then one has y = 0ё and 


(vlo) = (05 |ф) — 0(&|ф) — 0. 
(2.4) 


Gii) Again with ||w||? = (уйу) for all y € H it follows that 


[lv el? lly — ol? и іф? —illy+iol? | 


[w+ Фү+Ф)—(у—Ф|у—@) 


ri(y —ig|v —ig) i(y +ily +ig)| 


ylw) + (vie) + (ply) (ele) 
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Fig. G.1 Graphical 
jai mes of 


(vie) 
Фу YS 


— (viv) + (vie) + (Ф|) — (elo) 
+i(wly) + (vleo) — (ply) +i(@lg) 


іи) + (vle) — (gly) —1(Фф|Ф) 


= ilie] = (ио). 


Solution 2.2 Because of 


(vie) 


HE) (vio) VIP) (irl) 


X “wie YY 
(2.4 (2.5) 


(vie — y) 


it follows from Definition 2.2 that @ — m we Hy. This is represented graphi- 
cally in Fig. G.1. 


Solution 2.3 
(i) Let {ej} be an ONB and y = Y;aje;. Then one has 


(exlW) = (eel Laie) = бр едеу) = =, аби = ак 


pod 4) J (2.10) 7 


and thus 
v= (ее = Ум. (6.53) 
j 
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(ii) Next, 
(olv) Z (Doel veer) Z кш ул (еек) = Z УУ фид 
met j (2.4),(2.6) 7 * (210) і * 
= Yow = Xil ел. = Xolej teil). 
ш фу=(е|ф) 7 an j 


(iii) With y; = (e;|w) we have 


И = wiv) = Sel) (елу) => (ej). 
(2.5) (2.13) 7 


(iv) Finally, one has for 9 € Hy 1 that 


(wie) = 0= (vie, = (olv). 


Def. 2.2 (2.1) 


such that 


фа? = (e-- wle- v) = (ele) + (olv) + (v]e) +(wly) 
“Sans мч 


(2.5) =0 =0 
m 2 2 

= lel lel. 
(2.5) 


Solution 2.4 For y = 0 or ф = 0 both sides of the relation are zero, and thus the 
relation is true. Consider now the case y 4 0 5 @. Then it follows that 


2 
(vig) | (vio) (vio) 
0 < Ф— || = (Фф v|o y) 
ЛИ Ss Т ПЕ 
2 
ИСЕ (8 9) +|| ey 
2.4),(2.5) d M y 
EN 2 
" » (vie elv) (wie)(vie) , vie) 
m T ПИР ^ [nie I 
(2.5),(2.6),(2.7) 
_ 2 [vio 
c "Сур 
(2.1) 
and thus 
Ile? x llel? ily? (G.54) 


Next, we have 
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le-wl* = еу = Ko vle- v)| 
2.5) 
=, [lel lvl (olv) + (vle)| 
(2.4),(2.5) 
< [el lvl + gly) + Kwle)| 
< lel Ivi 21lell ivi (ем) 
“~~” 
(G.54) 


from which (2.18) follows immediately. 


Solution 2.5 For y = 0 the map is the zero map and as such obviously continuous. 
Assume then that y € НУ {0}. For any = > 0 there is a 6(€) = Тет such that for 
90, 9 € H that satisfy ||@ — qo|| < (=) it follows that 


ПФ = Poll € Ill] 6(e) =e. (G.55) 


= « 
(vie o)l < 
(2.17) 


Hence, (y| : ф +> lylo) is continuous at фо. 


Solution 2.6 
(i) First we show that (A*)* = A. For arbitrary |y),|@) € H one has 


(ИТА) 9), — ,(A*)* Фм) = (ФА) = (A vie), = (АФ). 
(2.1) (2.30) (2.1) (2.30) 


It follows that (w|(A*)*@ — Аф) = 0 for arbitrary |y). With (2.8) this implies 
(A*)*|@) = А|ф) for all |). 
(ii) Let c € C and A € І (Н) be arbitrary. Then we have for any |y), |o) € H 


(cA) w|e) = (VlcAe), — ,c(v|Ae), = ,c(A* ve), — cA" vl) 
(2.30 (2.4 (2.30) (2.6) 


— 
z= 


and thus 


(Ca -zayl =0 = 


(2.8 


— 


(iii) In the linear maps 


(Ay|: H — C СА: H — С 
ф — (Av|o) ' Фф — (wv|A* o) 
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one then has 


(Avlo) = (A7) we), = (vA e) 


= = 
(2.31) (2.30) 


and thus (Ay| = (y|A*. 
(iv) Let (]ej) ) be an ONB in Н. The claim (2.35) then follows from 


Ај = (ejl en) = AT)" ele) = (Ae ile) = lerle) = Ак, 
(2.22) (2.30) (2.31) (2.1) (2.22) 
(v) Per Definition 2.8 of the adjoint operator we have for any |é), |n) € H 
(0) (vl) En) = ile (vl) m = (616) (ит) 
(2.30) 
= Glen), = (Ф|) т) 
(2.6) (2.1) 
= ((lw)(@l)éln) (G.56) 


and the claim (2.36) follows from the fact that (G.56) holds for any |é), |n) € H. 


Solution 2.7 We show first that from the unitarity of U it follows that U*U=1. Then 
that this implies ||U y||= || || and finally that this in turn implies the unitarity of U. 
Let U be unitary. Then one has 


(Uy|Ug) = (vio) |у), |ф) € H 


GL UJUUe)-(wie) Viy) p) ЄН 


(2.30) 

=> (y|U*Up-)=0 V|w)|e)eH 
J2QU*U|o) -]e) 20 Vie) € H 

(2.8) 

=> UU=1. 


Now suppose U*U = 1. For апу |y) € Н it follows then that 


vil = v QT) 
(2.5) 
= wv(w|U*Uy), = v (U*)*w|Uy), = v (Uv|U v) 
(2.30) (2.31) 
= Ilo vil. 
(2.5) 


Finally, suppose that ||U y|| = ||w|| for all |y) € H. Using (2.9) twice it follows that 
for any |y), |p) € H one has 
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(Uv|U 9) 
1f 2 3x T TN. 
= 41v Uell -lUw-Uell *illUw-—iUol| illUw-iUel?| 
(2.9) 
lr ; : : Е 
= 1 ои) Пои Ф) ilo (vie) -ilusio 
lr : ; Я : 
= 4|Iv* elf — Iv — elf +illy—iel? ЕЯ 
= wie) 
(2.9) 


and U is per Definition 2.9 unitary. 


Solution 2.8 Let A| y) = А |y) for a |y) z 0 in H. 


(i) Because of 


(vi4*g) = (U vle) = Avlo) = Awle) =Alle) 


<> = 
(2.30) (2.31) (2.6) 
the linear maps 
(w|A* : H — C A(vy|:H — C 
9 — (v|A'9)' 9 — A(vle) 


are identical. 
(ii) With |y) 4 0 one has 


АОИ) = IA v) = yhy) = (A viv), — (Aviv) = Ayw) 


(24) A*CA 
Alv) 
(2.6) 


and thus A* = A implies A = A. 
Gii) Let U|w) = Ау) for a |) #0 in H and let be U unitary, such that 


vil Nevill = II wil, = IA wl 
(2.37) (2.7) 


and thus |A| = 1. 


Solution 2.9 Let {|e;,«) | j€{l,...,d},a@€ (1,...,dj) ) be the ONB of eigenstates 


of A, that is, let 
Ale ja) = Ajlej.a) ; (G.57) 
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where we allow each eigenspace to have dimension d; > 1. It follows from Defi- 
nition 2.3 of an ONB that any |y) € H with ||w|| = 1 can be written in the form 


d dj 
ү) = > Хх оё о) (С.58) 
j=la=1 
with "E | | 
Y X Wal = ИР - 1. (G.59) 
put (2.14) 


d 4 а dy 
мй с, (È È аел У У мый) 


(бз) Jte 
а а ар 
= У У wWawpte;alerg) 
j,k о,В=1 
d 4 
= У > Vj.a Wk prt (ej alek p) 
em jk o B1 ——— 
rx =ô}; k Ĉap 

d dj А 

=, Èlva А. (6.60) 
гло) J © 
Consequently, 

а dj 

X X vial 
5 ка! 

а 
PX 
(2.39) 7 (G.60) 

d dj 

< | d 
Sd vis É 
(2.39)? 

c 
(G.59) 


Solution 2.10 With (2.41) we have 


dj * dj dj 
p: = Pj 
TN = (5а (ua) = È leja) (ei.ol" = X leja) lejal =, 


(241) 4! MeL бл) 
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dj 
Pj = (х sal] Р; en): Y vied (ej aler p} (ekpl 


a=1B=1 


dj 
ap > 2, leja) дав (екв = ӧд » leja) a (ej, a|= OP 


such that P; satisfies the defining properties of an orthogonal projection given in 
Definition 2.11. 

As the (lej.o) j € I, 0 € {1,...,d;}} are assumed to be an ONB of eigenvectors 
of A any eigenvector |y) € Eig(A, Àj) сап be written in the form 


dj 
Iv). =, £ leja) (ој) = Piw) 


(2.20)! (2.41) 


showing that Р; is indeed a projection onto Eig(A, Aj). 


Solution 2.11 Let P be a projection and P|y;) = A;|y;) with ГАІ = 1. Ѕіпсе 
P* = P all eigenvalues A, аге real. From P? — P it also follows that 


2 
Àj = AT llul = АЛ) = ДУЛА? МЈ) = (УР?) 
(2.5) (2.4) 
= (иу) = (ilv), = Абу шу) = АР = Л). 
(2.4) (2.5) 


Hence, we have Àj = 0 or 1 and thus 


Р = MAlw)twi- У, Iw. 


me 42) J put 


Solution 2.12 Let |ф), |y) € H be arbitrary. Then 


(AB) w|o), = (v|ABo), = (A w|Bo), = (B'A' vio). 


(2.30) 


Z 


WY 
(2.30) ( 


Consequently, 


((AB)'-B'A')w|e) =0 Ҹу), [ф) ЄН 
& (ABy-Ba)v)-0 Му) €H, 


N 
оо 
=“ 
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which proves (AB)* — B*A* and thus (2.47). Next, suppose that also 

A* =A and B* — B. (G.61) 
Then we have 


[A,B] 20 & АВ=ВА = B'A 
WY Ww Ww 


= (AB)", 
(2.46) (6.61) (2.47) 


which proves (2.48). To show (2.49) note that 


A*A < сВ*В ә, 0< (w|(cB'B-A*'A)w) v|v)eH 
Def. 2.12 
S 0&zcy|BBy)-(wA'Av) Уу) ЄН 
(24) 
£  0<cBylBy)-(AylAy) Yy) ЄН 
(2.30),(2.31) 
des oxc|Bvi—||Avl? Viv) eR 
(2.5) 
e ПАМ € VelBv|| viv) € H 
ә, ПАП < vellall- 
(2.57) 


The last claim of Exercise 2.12 then follows from ||1|| = 1. 


Solution 2.13 If A is self-adjoint, then so is A? and it has the real eigenvalues 
(aj | j € {1,... d) and the same eigenvectors as A. Applying (2.40) to А2, we 
obtain 


= ur 2 
slay) = ДА], 
(2.40) (2.30) (2.5) 


such that ||Av|| € |Ag| for any |y) € H with ||| = 1. It then follows from the 
definition (2.45) of the operator norm that 


|A|] < Val- (G.62) 
On the other hand, any eigenvector |ej) for the eigenvalue Àq with ||eq|| = 1 satisfies 


||Alea) |] = ||Aalea) |] — |Aal leall = 1А. 
(2.7) 
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The definition of the operator norm given in (2.45) then implies 
||А|! > (Аа. (G.63) 


Together (G.62) and (G.63) yield ||A|| = |A4], which is the claim (2.50). 


Solution 2.14 Since AO = 0 the statement is trivially true for the zero vector 0 € Н. 
Suppose then that |y) 4 0. Thus, we have || y|| 4 0 and | | тет | | = 1. Consequently, 


1 1 у 
sns eds 
Iy] 7 ПМ Ily] 
(2.7) 
< ешр (АФ |l») € B. lloll = 1} = ЛІ. 
(2.45) 
Hence, 
[Awl] < ПАИ (G.64) 


as claimed. According to Definition 2.12 


||ABI| =, sup ||ABv|| | |y) € H, [|l] = 1} 


(2.45) 

« А| ||B ЄН, =1 
< вир { А ВҸ | ly) € H, ||| = 1) 
(G.64) 

< || sup {ву | Iv) € B. ||wl| = 1} 
ЕЕ 

(2.45) 


which proves (2.52). Again, according to Definition 2.12 


|А + B|| =. sup { ||(А++В)ү|| | |v) € H, |||] = 1} 
(2.45) 
< A B H, e] 
.&, spill || + ||Bv|| | lw) € H, || =1} 
(2.18) 
< supi||Avil | ly) €H, ||w]| = 15 +sup {||Byl| | |v) € Н, ||| = 1j 
= MAII ВПІ. 


Once more, according to Definition 2.12 
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llaA|| =, sup C llaAvil | |y) € Et, | yl] = 1} 


(2.45) 
= sup { lal l|Avi| | lw) € H, ||wl| = 1} 
(27) 

la|sup { ||Av]| | |v) € H, ||w]] = 1} 
Æ 1411411, 
(2.45) 


proving (2.54). 
Next, consider an orthogonal projection P which satisfies 


2: c. _ * _ 2 =: 
Р] = РР) — IP" Py) =, (VIP v) =, (ИР) 
(2.5) (2.30) Def. 2.11 Def. 2.11 
< Ру. 
< ПРМ! 


(2.16) 


) € H with || y|| = 1 and (2.45) implies that ||P|| < 1. 
On the other hand, the results of Exercise 2.11 show that there exist |w;) € H with 
||w;|| = 1, such that Ру) = |у). Thus ||Pw;|| = 1 and (2.45) then implies that 
I|PI| = 1. 

Finally, for a unitary operator U € Ц(Н) we know already from (2.37) that 
||U v|| = ||| for any |y} € H. Hence, (2.45) implies that ||U|| = 1 as claimed. 


Solution 2.15 


(i) To show =, let {|e;) = U|e;)} be an ONB in Н. It follows that U;; = 
(ex|Uej) = (ex|e;) and thus 


(UU*) = Убу Uj, = Y uuu; = 2, (ede) (eile) 


j 
= -Xi её) (ёе) = аха (ej]ei)) = (erler) 


C —À 
=|е) 


= би, 
such that U є U(H). 
To prove =, let U € Ц(Н) and |e;) = U ej). For any (aj) C C it follows that 


Xjajej =0 = XjajUlej) —0 
= U'UYjajej =0 =, Xjajlj-0 чш 
(2.37) Def. 2.3 


= UX;jajlej;)-0 
aj 0 Vj, 


652 Solutions to Exercises 


such that the {|e;)} C Н are linearly independent. Moreover, we have for any 


ly) ЄН 
U*|v) = Көл v)le;) У Ue;|w)|e;) = (eily)le) 
en j (2. 5$ s (231) 7 J 
=> ly) UU" |) = Ely lei) = Dele) 
(2.37) J J 


showing that any vector in Н can be written as a linear combination of (ће |2). 
Finally, we have 


(ejje) = (Ue Ое) = (e;jJU Шек) — (еек) =, 
(2.30) (2.37) (2.10) 


jk 


completing the proof that (|e;) ) is an ONB in H. 


(ii) 
FEAE) = ZUe jAV) = Y eju AUe) = LUAU) = F Unt, 
= = Ан b UU; ik = =F Av ZOU UU" )ix -Fau 
= 
= У (Аер). 
k 


Solution 2.16 
(i) For any A,B € L(H) we have 


tr(AB) = » (AB); = УАВ = У, BejA у = 3 (АВ) = tr (BA). 
J j,k Lk k 


(ii) The implication <= is obvious. To prove = suppose for all A € (Н) we have 
tr(AB) = 0. Define A" as the operator that has as the j,k-th matrix element 
(A^) jx = 9, ;,. Then we find for any r,s 


0-tr (A^ B) = Y (AP) Ву) = У бубу Ву) = By, 
jk jk 


such that B = 0. 


Solution 2.17 Let t — U(t,to) be a solution of (2.69). To show the unitarity of 
U(t,to) consider 
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d 2 d 
a; IU to) vl oe 
(2.5 


(Ui) y|U(t0)y) + (U О(г, oie U(t,to)W) 
(iH (r)U (t, t0) V|U (t,to) V) + (U(. t) іну) 


i ((H(U (rto) w|U (то) v) — (U (tto) v| H(r)U (t, to)y)) 


pis 


((Н@) U (t, to) WIU (tto) v) — (U(t, to) v|H(r)U (t, to)y)) 


Hence, for any |y) € H and t > to 


IU (¢,t0) l| = const = |0 (to,t0) vll, — lwl 
(2.69) 


and (2.37) implies that U (t,tọ) € U(IH) for all t > tọ. 
Suppose ¢ +> V(t,fo) is another solution of (2.69). The proof that it has to be 
equal to U (7, йо) is a repetition of the above arguments with U replaced by U — V. 


а (0,0) — V(t,t0)) v] 


< (Uto) Уб) Оо) Ую) v) 


Œ — i((H()(U(t.io) — У (t,t0)) wI(U(t.to) — V(t.to)) v) 
— ((U(t,t0) — V(¢,t0)) wIH(#) (И) — V(t,0)) v)) 


© 


Consequently, for any |y) € H and t > to 


| | (U (t.to) — V(t,to)) y| | = const = | | (U (to, to) — V (to,to)) y| | 0, 


кл 
(2.69 


which implies that U (7,70) = V (t,to) for all > to. 
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Solution 2.18 Since for all t > tọ we have 
О (1,10)*0 (2,10) = 1 — U (t,to)U (t,to)* , (G.65) 
it follows that for t = to 


1 = U(to,to)* U (to, to) О (їо, їо)“, 


<> 
(2.71) 


verifying the initial condition. Taking the derivative with respect to ¢ on both sides 
in (G.65) we find 


© (U(t.t0)")U(tt0) = -U(t.t) £ (U(t.&)) ; 


Multiplying both sides with i and with U(t,fo)* from the right and using again 
(G.65) we obtain 


iU (ro) = -U (t,10)* (i£ (00,0) U(t,to) 
e U(t,t0)* (H()U (t10) JU (t, t0)" 
(2.71) 
=, -U(t,to)"H(), 
(G.65) 


proving (2.73). 


Solution 2.19 


(i) To begin with, one has 


=N 


oy 


_ [01 01ү f10V _ 1 
110 10/ (01/ — 
and finds analogously o? =1= o2. Furthermore 
01 0—1 .(1 0 . | 
a= quei px) Р 
0 —i 01 .(10 ; : 
| 0 ) t i) --(%) АНЫН 
01 10 {0—1 ; f 
10/\о—1/^ 439] 102 = 218202 


= —ОзО| 


020) 


0103 
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01 


— 10, = 180316 
t) 1 23101 


10 
0—1 
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10 Е 


0203 
— 0203 


From this and оў = 1 follows 00; = $1 + iE О]. 


(ii) Hence 
[0j. ox] = Oj OK — Орбу = 1 + i€ jx = б) 1—1 ёи О = 21& О]. 
Ojk —Ejkl 


(iii) Again with ojo, = Ój,1 + i£ju0; it follows that 
{о}, Ok} = OjOk + Оро; = 1 + i£j OF + Ó,jldi £kjj Оу = 281. 
== 


(iv) That 0j = 0; holds is easily verified by using the defining matrices of (2.74) 


and (2.35). It follows that 


and from (2.37) that oj € U(2). 


— 1 


det (6x — А1) = aer ( 1 А 


Solution 2.20 To determine the eigenvalues of Oy we solve 
) —A2-1-2 
) be eigenvector for the eigenvalue A, = +1 and 


to find Ay. = +1. Let | 1) = K 
V9 
| Je) = (7) be eigenvector for the eigenvalue A_ = — 1, that is, one has 
vi| [01 vi Vz vp 
«(3-69 0)- (D) (9). 
Then vf = cvy holds, and with the normalization condition (ут)? + (v5)? = 1 we 
find 
1 (1) ]|O0-]D 1 E 0) —|1) 
£)——- = ———- and 4) = — = G.66 
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as eigenvectors, and thus 


for the probabilities. 


Solution 2.21 For o, we have determined in the Solution 20 of Exercise 2.20 the 
1 1 
. ; AOI A il : 
eigenvalues 4-1, —1 and the eigenvectors | Tg) = m b MEE Z (a) With 


these we obtain 


t 
(2.27 


NI = 
P 
— = 
—— 
cire 
юрке 
4 7x 
| 
— 
є | 
_ 
Ми 
Il 
P am" 
=O 
or 
Ми 


Solution 2.22 Recall from (2.83) that p; є О(Н) for i € (1,2) implies 


pi = р (G.67) 
(vipiw) 20 Ҹу) ЄН (G.68) 
tr(p;) = 1 (G.69) 
such that for u € [0,1] 
(ир1+(1—и)р;)` = upp +(1 = и)р> = ,upi-t (1— u)po 
(G.67) 
(vuit -upy =, ибрт) c1 -:)(vlpov), > 0 viv) eH 
(2.4) (G.68) 
GL “pi + (1—u)p2 2 0 
Def. 2.12 
tr(upi+(1—u)p2) =  utr(pi) +(1—u) (ро) — 1 
(G.69) 


and thus up; + (1 — u)p2 € D(H). 
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Solution 2.23 In order to show (2.84), we need to prove that UpU'* satisfies all 
defining properties (2.80)-(2.82). 
To begin with, we have 
(UpU*)* = (U")"p"U" = Up*U* = Шри 
(2.47) (2.31) (2.80) 


proving that UpU* is self-adjoint. 
As for positivity, we observe that for any |y) € H 
ж = * * > 
(V|UpU* y). = ХО v|pU" y) 2 0 
(2.30) Def. 2.12 and (2.81) 
and thus, again according to Definition 2.12, it follows that UpU* > 0. 
Lastly, 


tr(UpU*) = tr(U*Up), = (р) = 1 
(2.58) (2.37) (2.82) 
verifying (2.82) for UpU* as well. 
Solution 2.24 Let the density operator be given as 
Py = wit (G.70) 

for a pure state |y) and let 

А = Y Ае) (ex (G.71) 

k 


be an observable given in diagonal form with the eigenvalues {A4} and {|е)} an 
ONB consisting of the respective eigenvectors. Moreover, let P, denote the projec- 
tion onto the eigenspace of A € {Ax}. We proceed to verify that the generalizations 
for the expectation value, measurement probability, projection onto the state after 
measurement and time evolution given in Postulate 6 for py coincide with the state- 
ments made for a pure state |y) in the Postulates 1—4. 


658 Solutions to Exercises 
Expectation Value 


(Ao, = tt (py) = tr(lw) (wl) = (iv (Elei) a!) 
(2.85) (G.70) (G.71) 


= ми 


— 


)(wlex) (exl) GOMA ej| v) (yle) (екеу) 
LL 


RAF 
(2.57) E 


2 V|ex)(ex|w) = (Ие) (еси) — (vlw) 


І 


mt 
CL Uy 
(2.60) 
Measurement Probability 
Poy (A) =, tr(pPi), = tr(lw)(wiPa) =, (ци) (ИР) 
(2.86) (G.70) Def. 2.11 
= Ш(РАЦИ) (ИР) = 2e P у) ЇР, в) 
(2.58) (2.57) 
=, Уер) (Рек) = (Pa wl le) (exlPaw)) 
Def.2.11 * £ , 
D 
=P, |y) 
= (РР) = ПРА? 
=, Py(A) (G.72) 
(2.62) 
Projection From (G.72) we see that 
ш (руРл) = Ila vill (G.73) 
and thus 
Рурур  _ Ру _ RIWI Ру) (Pa 
t (PPa) усе) ПР, oo, lay? es) Pa wll? 
_ Bw) (Pyl E 
IP will [LP wil] ТУ. 
that is, TAPPA. Mns PA is the density operator of the pure state j ms 


Time Evolution Let p(to) = Py) = |w(to)) (W(to)| be the initial state апа p(t) 
be the state at time t. Then we have 
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p(t) = ,U(t.to)p(to)U(t.to)* = U (t,0)| W(t0) (vto) |U (t, to)" 
(2.88) 
5 lU (t, to) vto) (U (t, to) WO) | — ,Pu()wto)) 
(2.33) (2.70) 
SP): 
(2.71) 


that is, p(t) is the density operator of the pure state |w(t)) = U(t,to)|w(to)). 


Solution 2.25 We have 


(A)p ,— (pA), — tr БО) = M pit (lw) (ИЛА) 


J J 


(2.85) (2.100) 
20 Уди) (ила) = Уруум) (G.74) 
57) j So J 
and thus 
Ы (Уу; УЛАР Vi) È VPIPK VIIA VK) 
60) eine 100) 7 (2.4) Si 
= = Урд vj|Av;) + УУР» (WAVE) =, (А) + У, VPIPr WAW) - 
dii 776 


Solution 2.26 То begin with, we have 


p = (+00 = 255 (1) manes (9) 00 


(G.66),(2.78) 


> у 309 1441 
—— 5\11) 5100) 5\11] 


(2.29) 


Obviously {г (р) = 1. To determine the eigenvalues pı 2, we solve 


4-A 1 \\ ua 
det(p — A1) = e(t 14)) 7^ -4+5 = 0 
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and find p+ 


Di, that is, 


4u+ +v+\ _ 
Us d: Va == Р+ 


As a solution of that we find after normalization 


With this we obtain 


Е 1 2 
Ws) = m vns) 
PV) + ри) и | 
Iq 2 = 
= 56/3 eim (via) 68-9 
EE та: je 18 99) 
us 2/13— е) 
= 562 со 2/13 — 6 22 — 6/13 
ee 
EE 24/13 — 6 22+6\у13 


~ 10 


1 
5 


E 


9-09 


To show that p > p°, we first observe that 
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) be the eigenvectors for the eigenvalues 


2:304 1/41\\_ 1 (205\_ 1 {175 
P-P =3\11 54111) 25,55] 25\52 
_1 [30 
~ 25\03/` 
Now let |ф) = id € H {0} be arbitrary. Then 
1 24 2 
р - e) = (ө ex) 35 (09) (9) - 2-9 


and thus p > p°. 


>0 Мф) єн {0} 
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Solution 2.27 Let |9),|w) € H. On the one hand, we have 


Pety = (19) + |w)) (Go] - (wl) 
= [eel *- 1e)(v] + Iv) (el - |) Qv] 


and on the other hand 


Раев = (10) -l*v)) ((ф|+ (el) = (1e) ее) (tol e" (ul) 
= |e)te|--e |o) (v| - e" |w) (e| + |) (и, 


such that 


Pose Рену = (е 1) |ф)(у]+ (е 1) Iv) (ol. 


Solution 2.28 Generally, we have for the probability to measure the eigenvalue А; 
of A = Y; ej) 4;(e;| in the state p 


(Pei) p = (Pep) - (G.75) 
(2.86) 


For pure states py = |) (y| this becomes 


For A = 0; one then has Ay = +1,A2 = —1, |е) = |0) = (0). lez) = |1) 


Il 
A 
— о 
М2 


(i) With |y) = | fs) = 315, Eq. (G.76) becomes 


V2 
ye eles 
Paay КаПо = o 3E — 
(ii) With |y) = | 1s) = 92%, it follows similarly that 
_ 2 [a9 -ID 1 
Paay = if 01019 = 
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(iii) Likewise, with |y) = 5 (| Та) +] 15)) = 10), it follows from (6.76) that 


(Р) у = Keil P = КОЮ) = 1. 


(iv) Finally, one has with р = 5 (| TS) Ted] +] Le) ( 19) and | 1) = 
1 


55 (10) + |1)) = -5 (1) as well as | [3) = z (10) —|1)) = 5 e that 


esse) s) 
-i «C 03) 
1 
—-1. 
Then (G.75) на 


1 
(Pa) = 1 (Pa 51) Ny 


Solution 2.29 From (2.76) in Exercise 2.19 we know that ojo, = 31 + i€ jx}. 
Using this, we find 


(a: c) (b.c) = У ajb,ojo, == Уа; (51 + i€ x07) 
jk тафт: 


= Уа 1 +1У азр о 
jk jk 


= (a: b)1 

+ i (a1b2£12303 + a2b1 £213 03 
+ aıb3£13202 + азр £31202 
+ a2b3£23101 + d3b5£32101) 
= (a-b)1 

+ i(aib2 — азр ОЗ 


) 
+ i(a3bı — a1b3)02 
+ i(aoba — a3b2)01 

= (a-b)1+i(axb)-o. 
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Solution 2.30 We have 


1 1 : 
tr(pxoj)) = tr (zie о)о)) = 51 (si Ухо) 


(2.127) 
1 
= <=tr(o;)+= LS tet 0,0) 
2.22 2 
=0 
= Èa j= Sl ) 
PR Xy tr 15 +18161 = ôkjtr(1 ) +16, tr (07) 
2 1 2 1 Se м2 
(2.76) =2 =0 


ig)?! 
2j 1)! 


N 
T 
4 
> 
Dei 


=COS 0 =isina 


= cos &l +isin gA. 


Solution 2.32 Let f є Ss and o, B € R. Then we have 


[04 vos Обь s P 
Da(a)Da(B) = (cos Ž1 -isin а-о) (cos 61 isin а-о) 
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a+p. 
û-o 
2 


= (соз cos sin sin®)1 isin 


Solution 2.33 From Lemma 2.32 we know already that there exist a, B, y,ó € R 
such that in the standard basis {|0),|1)} the matrix of U is given by 


i е-123° cos 7 ше sin 7 
U = е 8—6, y B48 ү : (G.77) 
7 е! 2 sins е 2 соз» 
(2.133) 2 2 
On the other hand, we have 
ô, » 
D;(0). = cos 51-isin72. о = cos —1 — isin — 6; 
(2.31) 


- 6 
| (cos а — isin$ 0 _ [е2 0 
0 cos 2 +isin$ 0 еі 


and 
Ру(у) = cos 21 -isin 7ў- о = соз T1 isinZo, 
(2.31) 
Е cos + —sinZ 
n sin 7 cos 7 
such that 


: В 7 6 
[ех 0 соз7 —51п7 e'2 0 
о.» | 0 x) i i) | 0 H 


_{8+8 19-8 . 

| [e 3 cos% —е 2 sind 
Tm , ‚ В+6 E 
ez sin? e! 7 cos 5 


Together with (0.77) this results in U = e'"*D;(B)Ds(y)Ds(6). 


Solutions to Exercises 665 


Solution 2.34 
oD (N) =, 6 (cos 1 — isin 1$. 6o. 
Tm SA ЖАТУ 2 3 
(2.130) 
= cos Ш o? ~isin 1 040, Ox 
2 Sn 
=1 =іс; 
= cos 71+ sin 2 0:0; = cos T1 + isin Тоу 
—io, 
= Dsn). 
(2.131) 


Similarly, one shows the second equation in (2.151). 


Solution 2.35 Let 


Setting 


yields 
3 f 
204-23 21 —iz2 ab 
= " = =A. 
D220 F +iz -— b à 


From Lemma 2.35 we know that there exist a, Є R апай € 513 such that for any 
A c UH) 


A = el? Da(£) 


where we now have set 


zo =e’ cos 2-, z= —isin 


2 


such that 


2 2 25 |2562 26.26 
+14 = = + = lal” = >+ ==]. 
[zo|- + |z|^ = cos z 5m 21 |^ = cos 5 tsi 5 
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Solutions to Exercises from Chapter 3 


Solution 3.36 


(doen) (En) = Elp (nly) = atle) — a (10) & 1v) (&.m) 


Ww 
(3.1) (2.4) (3.1) 


Similarly, one shows |ф) @ (a|w)) = а(|ф) & |w)). Next we have 
(allo) &|v)) +0(1ф) & ъ))) (б.п) = alle) & v) (6, т) + (19) & |w)) (5. m) 
5 Elo nly) * (51e) (nly) 


= (a+b)(é|9) (nly) 
= 05 (l9) ev) (én) 


and 


(0) + |ф2))® м) ) (п) (SIC) + 1e) (lv) = (0811) + (102) (lv) 


"y 
eu 


(S11) (mlw) + (Ele) (ту) 
(Ie ev) +192) 81v) (E. m. 


Oo 
ZH g 
ee 


Similarly, one shows 


IP) & (wi) + |у) = 1e) @| Wi) * 19) & |). 


Solution 3.37 Suppose the Y,» € C are such that 


Yes fo) =0є H^ еН”. 


a,b 


Hence, (3.1) implies that for any (E,7) € НА x HË 
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(Z aleae) Eom Fm. S pleal) ln) = 
3.3),(3 


a,b 


and in particular for every (6,1]) = (ey, fy) 


0 = Уҹ (ealea') (|) = Tu - 
Мй 


a,b 
Ona! ô, y 


According to Definition 2.3 the vectors in the set {|e, ® fp) } are then linearly inde- 
pendent. 


Solution 3.38 Let {\e,)} be an ONB in H^ and {|f,)} be an ONB in HP. 
The expression (Ҹ|Ф) as defined in (3.7) is positive-definite since for any |) = 
Dab Vap|ea & fp) we have 


(PIY) => Ea? eo 
a,b 


and thus 
(Ф\Ру=0 & Ww=0 Yp € |#)=0. 
Moreover, let 


(124) := U^ Jea) = Yea |U"ea) leai) = YUayaleay) } C E^ 


ay ay 


П) = U? | fs) = Y fo, IU? fo) fo) = Уһ) cH” 


bi 


be other ONBs in НА, resp. HP. From Exercise 2.15 we know that then the maps 
U^ : H^ — H^, UP : HË — НЗ are necessarily unitary. Thus, we have 


Ф) = > Фаь lea 8 foi) = Фы&®) 


a,b 
= = УФУ, Uf alea) Sut) - у у ОА UP pParlea, 8 foi) 
a,b а a,b, a,b 


from which it follows that 


Dab, = > ОА АОВ yap . 
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Similarly, we obtain 
Vb, = D Us Una n 


and thus finally 


2 Top, Pab, = = by SUA UP Fao ULF Ma ab 2 ША „Шр Oi ab» 


ay,b, aj bj a,b a», b» 
= A B 77B 
— > 5, X ОА UA „ОР „UË p Va oo, 
a,b a2,b2 aj bj 
— Ax ттА Вх ттВ 
>, > £ > Оаа Шаа» > Upp, Uy p, [LN 
a,b a» b» aj bi 
=ӧааз =, 
= у Fab Par ; 
a,b 


that is, (Ч\'|Ф) as defined in (3.7) does not depend on the choice of the ONBs {ea} C 
HA and {fp} c HP. 


Solution 3.39 


(Ф+|Ф*) (00 + 100+ 11) = 5 ((00|00) + (11100) + (00]11) + (un) 


o a (910) (010) + (uo) (10) + (011) (011) er arm) 
(3.4) =1 =0 =0 =1 


- 


1 1 
(+IP) = „(00+ 1100—11) = = ( (0000) – (00111) + (1100) — (11111) ) 
2 А аА чы Аи 
=1 =0 =0 =1 


= 0. 


Analogously, one shows 


uU p epog 
(PHP) = 0 = (PFPE) = (OF |¥*). 
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Solution 3.40 For i € {1,2} let |;) € H^ and |) € HP. Then we have 


(M^ & MP)'oie vile» ® vo) = (91 @ vil (M^ & MP) e ® vo) 


Ww 
( 


(q1 & үл |M^ p & MP yo) 
(1|M^ 9») (ул |MP yr) 


I 


э? 
((M^)* 91192) ((M?)* wi у) 
((M^)* p1 & (MP)* vi |» & va) 


= ((M^*e&(MP))e ® үл |ф› & vo). 


Solution 3.41 Let {|@,)} C H^ and {|f,)} C HË be two other ONBs. From 
Exercise 2.15 we know that then there exist unitary operators U^ € u(H^) and 
UPc U(H? ) such that 


|да) ED lea) = LY, а! D 


(G.78) 
fo) =U? | fo) БУЛТ 1 
b 


Let Mab, ab be the matrix of M in the ONB {|é, & A) Then 
Mabi аЬ» = (ёа ® Js |M (ea, 8 fos) 


(04 а |а 1) 9 Ui, |ы, /)|M (U, а! A ва) 8 Up ь,|/ы,))) 


(G.78) ^ а! bi ab) 
= A B 
"^ GATA ta Up p, Оба Он, (Cat, ® Fo, M (ea, ® fi) 
abia АД 
(222) 4 
= B 
Е РУ " U^ UR, пај Uj p Uj Ui p, Mai САДЫ 
а! 
1 


where we can use that (2.35) implies 


UF UF, = (0%); , (0); 


а 141 bibi ауа) bibi 


670 Solutions to Exercises 


and we obtain 


у Мо\ь,ауь\®а\ ) (èa | 


ajab 
(0), 


ayaba Б а,Ь, 


= ^ (xut. 0^ iain (Se Jaya, ča) | (zu. E ы). 


мы а 
a bab, N b 1 


ауа) 


y (UP) ы Ul a, U, pMa, v a,v, Čai} Ea (G.79) 


Here we can use that U^ and U? are unitary, hence UP(UP)* = 18 and thus 
> ОЬ), = б, (G.80) 
b 


as well as U^(U^)* — 1^ and thus 


24 d |да) = У, D Ufa, lez) = рУ » Uta, (U pe | leu) 


а (6.78) aja! a! 
x 
= le.) : 
Likewise, we have 
YU, (ёа, = (ea, |- (G.81) 
a? 
Inserting (G.80)-(G.81) into (G.79) yields 
> Маь,аь ёа) (èa | = У; Ма ы а, ду y, lea’) (eu; = у Мао ёа) (е2] , 
ajab а b аз], aja? 


which shows that in (3.46) the right side in the equation for tr? (M) does not depend 
on the choice of the the ONBs {]e,) } and {| fp) }. 


Solution 3.42 We have 


tr (tr? (M)) = tr (1^ tr? (M)) 


and the proof of the second identity is similar. 
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Solution 3.43 Let (]e;)) be an ONB in H^ and {|f,)} be an ONB in IH. Then 


(еа & fp) } is an ONB in H^ @ H and the matrix of M^ ® M? in this basis is given 
by the right side of (3.35). Consequently 


tr (M^ ® MP) Z У (м^ DM”) а= (хма) (хм) 


(2.57) ^? (3.33) 
a tr (M^) tr (м?) ; 
(2.57) 
Now 
tr? (M^ әм?) = У, (t? (M^ &MP)), , lea) (eal; (G.82) 
4] ,d2 
where 
(tr? (м^ &M^)),, а, Tas > (м^ & M^), barb = Maas Y Mp, 
(3.52) ^ (3.33) i 
e МА a tr (MP) ; 
(2.57) 


and thus (G.82) becomes 
t? (M^ әм?) = M^ tr (MP) . 


The proof for tr^ (M^ @ M? ) = MP tr (M^) is, of course, similar. 


Solution 3.44 According to (3.44) one has in general for a |У) € H^ & Н that 


р^(Ф) = у Tob Fa,bl€a,) leal, 


a ,a2,b 


where the {|éq;)} are an ONB in H^. With H^ = *H = H eo) = |0)4, |e) = |1)4 
as ONB in H^ this becomes 


- (Poo Pio + 1 
+ (Fio oo + 11 
- (Potio + 34151) DAA]. 


(G.83) 


For the BELL states 
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о) = 75 (09) £111) 
#*) = (о) 119) 
we find 
d$ = toji = Vi =н 7 (G.84) 
Фу = di = M = HE =0. (G.85) 


Inserting (G.84) and (G.85) into (G.83) results in 


руф?) = p(w) = 5 (1040 + ^q] = 31^. 


Similarly, one finds using (3.45), that 


p®(@*) = pP) = 2 (0)5(0| + In^) = 21^. 


Solution 3.45 Any basis [v;| j € {1,...dimV}} of V can be used to form a basis 
(vj, & vj, ) of V" such that any vector w € V^" can be written in the form 


W= У и. мул 9: Ур. 
ШЕ 


This allows us for any set of A1,...,An € L(V) to define the action of Aj ®---@Ay 
on any w € V?" by 


(Ai [E -@A,)w = у Wi. (АУ) ® «++@ (AnVj,) š 
JA Jn 


such that 
A18: GA, E L(V®") 


and it follows that 
LV c L(V®”). (G.86) 


Using that 
dimL(V) = (dimv)? (G.87) 


and 
dim V?" — (dimV)", (G.88) 
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we find 


dimL(V)°" — (dimL(V))" — (dimv)” (G.89) 
(G.88) (G.87) 
and А " 
dimL(V^"), = (ашу®") = (dimv)™ (G.90) 
(G.87) (G.88) 


and (G.86) together with (G.89) and (G.90) imply that L(V)?" = L(V®"). 


Solution 3.46 First note that for any |у) € НА ~ {0} we have 


(v) (v| 91^? = у) (р) (vi e 12 = Р (v)(wie15. 69 
(2.5) 


Using an ONB {|ea)} E НА, we find then 
(vi by К by) Кы ba) V) 
bib» 


У (Vlen) en Y, К, Kin jtd) (бы!) 
1,42 


(2.43) 21:02 
= X (eos еа (eal Ж Kt, iba) КЬ) ёаз) 
= Ki K, 
ы «(m vivi 2, (b1,b2) Т) 
CX viu? (( (1^ & \/p8)V*V(14 & Vp?) ))) 
3.84) 
= (0м) иат) e vp5)v*va a v/pP)) 
3.47) 
zo у: "(0% е1) в /р#угу а^ vph) 
(G.91) 
E А з ((()(у1®1°)(1^® /pP)v*v^ e v/p5)(v)(v| e 15) 
(2.58) 
= E zt ((ly)vle Vp Vv (у) wie \/р®)). 
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Solution 3.47 Using an ONB {|e, Q fp) } СНА & HË, we obtain 


t (v) )(wl@ v/pP)V*v(lw) (vle ур?) 
У (ea ® fol (lv) (wl & V/pE)V*v (Iw) (v| & V/p)es & fo) 


(2.57) ° 

=, Evye Vpr) eaS УУ (ly) (W1® ур?) ел9 fo) 

(2.30) a,b 

=, У) (И 9 УР) са 9 ЉІУУ (Пи) (ие vpP)e ® fo) 

(331) ^ 

=, Evye vpreg УТУ (y) y] ура) еа & fo) 
(3.81),(2.36) ©” 

= DYilv)(vlea) ура)" У (|) (lea) & v/p1fo))) 

a,b 

=, Xe (ly) 9 VPV (lw) ® VP) 
(2.4),(2.6) ^ 

Zs к} ledy (Iw) & VEIY ® v/p|fo)) 

a,b 

(3.73) , 

=, «ily ? Y (viv) G/ plo) | v/ pP|.fo)) 
(2.12),(3.4) B 

=, к ДЖ км" Уфы 

(2.5) (3.79) 

=, xlv "Eat = ку i. = к |у. 

(2:7) =] (3-77) 


Solution 3.48 Combining the ONB {| fp) } of HI? used in (3.87) to define V with an 
ONB {\e,)} of НА to form an ONB [|e, & f?) of H^ & HË we find 


(V* (ea 8 fol & fi) (ea fo|V (wr & fi)) 


Z 
(3.87) 
р Hlhi) = (ea|Kp V) . (G.92) 


l 
pe 


pom 


(«елку ®|Л)) 


^ 


Pd 
34) 


With this we obtain for every |y & fi) € {H4} 
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(v filV*(es& fo)) =, (V*(e& fü)|we fi) — , (esl Ko v) 


Z 


(2.1) (G.92) 
Jy (Kyw|ea) =, (w\Kpea) 
(2.1) (2.30),(2.31) 
= È (VIK геа) (ifo) 1|) 
1 
тұ 


E (Elvik ® (il) (lea® f) 
(3.4 1 


proving the claim (3.88). 


Solution 3.49 Let a;,...,aj,bi,..., b, 4, € C" be such that 
А= а-а» |, В = bi bios 


, 


where the a; are given and the b; are yet to be determined. Moreover, set 


V=|AB 
Then we have 
a-a] е aj -an a, -b; vA aj: b, yu 
V*V = Am Al co yy an by Ut am buo 


bı -ai ides bi -am bı -bı er bib, D 


b, ape Ь, ‘am Ж -bı pu b, n bn-m 


where 0 · v = DI 1 4jv; denotes the scalar product in C". For V*V to have form 
given in (3.90) the b; have to satisfy 


a-b,=0 — VIE(L..., m ke (L...,n—m) (G.93) 
b; -bg = сб Vikc {1,...,2—m}. (G.94) 
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Each of the n — m vectors b; has n components giving us altogether n(n — m) 


unknowns. Equation (G.93) gives m equations whereas due to the symmetry (G.94) 


(n—m)(n—m+1) 
2 


provides equations. As long as 


+m < n(n — m) (G.95) 


we can find the b; and thus the matrix B € Mat(n x (n — m), C) delivering the 
required form (3.90) for V*V. Rearranging terms shows that (G.95) is equivalent 
to m(m 4- 1) € n(n — 1). Since by assumption n > m it follows that n — 1 > m and 
n 2 т+ 1 which guarantees m(m-+ 1) € n(n — 1) and thus (G.95). 


Solution 3.50 Since an orthogonal projection PP satisfies 


1^ gP? = 1^ @ (РВ)? = (14 @ PË)? (G.96) 


and 
(14 @ PP) (G.97) 


i {i 


tr (1^ & P®)U(p* @ pP)u* (14 @ P*)*) 


tr (a^ e P®)U(p4 @p*) ((14 @ PP)u)") 
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Solution 3.51 For any x1,X2 € Bhs and u € [0, 1] we have 


Рихү-+(1—и)хә Z ; (uxi +(1 — u)x2) о) 
(3.107) 
= ил (1x0) 072); (1*6) 
2 2 
=, HPs t - Ш)», (G.98) 
(3.107) 


and thus 


K (uxi + (1— u)x2) tr (K(Puxi+(1-u)x2)0) = tt (K(Ups, + (1— и)рх„)о) 


м 
(3.108) (6.98) 
JL ч(ИК(рх,)о + (1— и)К(рх,)о) 
(3.106) 


ич (К(ра)е) + (1 =H) (K(pss)o) 


uKQa) +(1—и)К(х›). 
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Solution 4.52 According to the starting assumption, р^ and р? are given as in 
Definition 4.1, that is, each of them is self-adjoint, positive and has trace 1. From 
(3.32) it follows that then p^ & р” is self-adjoint. In order to show the positivity of 
the p^ & p? note at first that 


p^ &p? = (p^ @1) (18 p?) = (1e pP) (p^ &1), (G.99) 
where also 


(р^ 81)! = р^®1 
(18pP)' =1@p?. 


Both p^ & 1 as well as 1 ® р” are positive because for an arbitrary vector 
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= bx e | fb) Є HA ® HË 
a,b 


we find that 


(Ф|(р^ & 1)') epit b» T by Pops (Cai ® fy, (p^ & 1)e;, ® fo) 


(3.8) a1 a7,b,b 
A 
X У Fabi Фаь, (ёа |P а) Ubilfo;) 
(3.29) ajaz,bıb2 —— 
= 
= у Frb vob Cai |" eas) 
ajaz,b 
= 2x Хел |р“ px 
b a 
oss 
= Wp 
A 
= У (уыр Wo) 
==” 
>0 
> 0, 


where the positivity of p^ was used in the penultimate line. Similarly, one shows that 
16 p? is positive. Since the p^ & 1 as well as the 1@ р? are self-adjoint and positive 
and according to (G.99) commute, it follows that for every pair p^ & 1,16 р” there 
exists an ONB |е. & fp) in which both are diagonal 


p^&1 E Y Alea 8 fo) (ea ® fol 


a,b 
18 pP = bes fo) (ea ® fol, 
where due to the positivity of the p^ 21,19 p? we also have 
aX,>0 forX € {A,B}. (G.100) 
With (G.99) one obtains thus 


p^ &p? = Улога fes 8 fo 


and because of (G.100) it follows that p^ @ p? is positive. 
Finally, the trace property for p^ @ o? follows from 


vient) (иаи) =1 


(351) Сү Ži 
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Solution 4.53 With the results of Exercise 2.20 as given in (G.66) we have 


l()--[D) — and |а) = — (I0) ID) 


| Ts) = 5 5 


S 


such that 


JO) |D , I e|. 10) I0 „ 100 — ID) 


| Tz) @| Tx) +] Le) @| Le) = A V8 B em 


= 5 (100) +101) +110) +|11)) 
+2000) |01) — 110) + |11)) 
= |00) + |11). 


Solution 4.54 Per definition (2.125) and (2.126) one has 
ei? cos 2 T 0 T 0 
| Ta) = di » =e '? cos 510) +e? sin = |1) 
e$ gin 9 . 0 Е 0 
| la) = | s ius ) а: sin = |0) tet cos 7|) 


and thus 


| Ta) 8| La) — | La) & | Ta) 
-i$ Ө i$... 6 1%. 0 jb. 0 
= (e teos Slo) ee аз) ) e (-e sin $0) ee cos 11) 


= ($ sin 2 |o) + еї cos in) ® (= cos 20 m sn) 


= —е !#со$ М sin 200) + cos? 201) — sin? 210) -- el? cos М sin |11) 


i 0. Ө 0 0 0. Ө 
—[—e i? i in? 27 ip — sin — 
( e '°соз = sin = |00) — sin 2 101) + cos 2 |10) + e’? cos 7812 п) 


= |01)—[10) — apr). 
(3.28) 
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Solution 4.55 Since fi in the result (4.25) of Exercise 4.54 is arbitrary, we can 


choose fi = fi^ and write |) as 


» 1 
I) Fe ta el la — Ha) ӘТ). (G.101) 
with УА, = ñ^- c and X7, = fi? - c it then follows that 
CELOM = (Ф|(й^-о®й#-о)'Ф^) (G.102) 
= L (Pi -ol Тл) Bñ” -0l La) - 8^] Lys) OA? 6| Tg) 
V2 —— —— 
=+|1л) =—|la) 
1 
= ATN Ta) & P - | laa) +l Lea) SÂ” -ol 134)))- 


In the last term we can use the following identity 


-olla = f^. c(-R& .o)|lj) 


= -(8^.c)(8 .c)| La) 
(вв. $ 


Ww 
(2.121) 


Analogously, one shows 
AP o| Taa) = (BE -8^)1- iC? x 8) -0)| Т). 


Inserting (G.103) and (G.104) in (G.102) yields 


— ñ? . ñi 


(хез), = Ta T 91) 7 Had S fa) 


(P7 |(| 154) ® (8? x *) -ol Laa))) 


(P| (| Las) & (8P x 8^) с] 154))) 
а^ (PTP) 
(G.101) Ži 


(Tad @ laa — dla 8 Тол | Tg OÔ? хд) с })) 


(Taa @ laa — laa @ Taa м &(fi? x ^). o| 1a4)) 


(G.103) 


(G.104) 
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-.à^ (G.105) 


(8 х а) -ol Laa)) + (Те, (89 xh) 61 194) 


N 

г» 
— 
pe 
gs 


In order to show 
(А & I) =â? ût, (G.106) 
n n y- 


we prove that in general for M, ñ € Shs 


(la 


M-o |а) - (Ta |th-o Ta) =0 (G.107) 


holds. With rh = f? x й^ and fi = f^ it then follows that the second term in (G.105) 
vanishes. To show (G.107), we consider first ñ- o| Та) in the ONB {| Та), | la) : 


їй. О| Ta) = аа| Ta) + ml La) - (G.108) 


If bm = 0, it follows that 
їй. 0| Та) = aml Та), (G.109) 


and ањ is an eigenvalue of № · с with eigenvector | Та). From (2.29) it follows 
immediately, that (№ - 0)? = 1, and thus the eigenvalues of ñ- с are given by +1. 
The eigenspace for the eigenvalue —a,, is one-dimensional and orthogonal to the 
eigenvector | |a)for the eigenvalue am. Hence, 


m-o| а) = –аһ| la); (G.110) 


and (G.107) follows from (G.109) and (G.110). 
In case by Z 0, we obtain from (G.108) because of (| 


Ta) = O first 
(la [й-о Ja) — ai. (G.111) 
On the other hand, because of (№ · о)? = 1 it follows from (G.108) also that 


| fa) = an - 0| Ta) + ban - o| |а) 
= ag (am| Ta) + | La)) + batho] La) 


Taking on both sides the scalar product with (|a | yields, because of by, 4 О and 
(la | Ta) = 0, thus 


(la №0 la) = –аа. (6.112) 
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From (G.111) and (G.112) follows (G.107) also in the case by 3 0 and thus 
finally (G.106). 

Alternatively, one can verify (G.106) also by an explicit calculation, making use 
of the representations fi, | Taa) | laa) âl o in (2.122)-(2.123) and (2.125)- (2.126). 
But that is equally lengthy. 


Solution 4.56 Since fi in the result (4.25) of Exercise 4.54 is arbitrary, we can 
choose fi = fi^ and represent |) as 


E 1 
kg = 5 (1) 1 la) - Ha @ | Taa) . (G.113) 


With УА, = й*. с we thus have 


(ха әт) _ = (ФО|(й\-о®1)'Ф^) 
= = “jít. A a) âi. sA aA 
= "d а -o| Tg) 91150) 7 R70] Lat) S] Tea)? 
(SALTS) —-Hta4) ——|lga) 
1 
= o | faa 8 laa + laa 8 Taa) 
1 
D 2 a^ ® laa — Lat ® fia | Taa ® laa + Laa @ Та) 
(G.113) 
= 0 


where we used (Т ал | Та) = 1 and (Тол | 154) = 0 in the last step. 
Analogously, one shows that (1 ® х2, = =0. 


Solution 4.57 With 


Ха = h-o 
M-o) tin) = 11) (G.114) 
(2.124) 
(h.c) = theo (G.115) 


one has 


Solutions to Exercises 683 


(Xa) = (10:6) fi) 
=, „[(бё-о) [а Каго) 1) + (Та [(@-о)(бй- с) 1) 
(6.114) 
l А 
= ita Пов о) (а-о) + (8-0) о)] 1а) 
(8.115) 
=, S |[й-й)1+1((й хй)- о) + (й-й)1-+-1(й x h) о)] fa) 
(2.121) 


Solution 4.58 To begin with, we have 


P, |?) rd (lea) (ед| 918) У V, plea) Q |) = у Fasplea) (еа|ег,) 0) 
(4.49) aj,b a,,b [тей 


= Уе) 9 |fo), 
b 


which implies 


P, |Ҹ) (|Р, = У, Фа, Фа, lea) ® |fo,) leal ® (Љ,| 
bib» 
(3.8) 21772 


= Чоь, Piles) Cea] ® n) Soal- (G.116) 
(3.36) 2122 


Inserting (G.116) into (4.51) yields 


p — Y, У, asus |а) (eal ® |Ъ,) (fos (G.117) 


a by,b2 


for the density operator of the composite system. From Corollary 3.20 we know that 
then the sub-system in Н is described by 
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p'(p) = w^ (p) = , v » У Yo Fars lea) (eal ® ПШ) 


(3.56) (G.117) а bb; 


= у Pb, Ep, tr^ (lea) (eal ® |) foal) 


ZÀ Pav, Faby tr (lea) (eal) | foi) (Foo! 


where we used in the last equation that tr(|e;) (eal) = tr (Pe,) = 1 for any pure state 
lea) 


Solutions to Exercises from Chapter 5 


Solution 5.59 To begin with, we have for any V € U(‘H) 


(V*—1)(V—-1) =V*V-V*-V41 = 21-V*-V (G.118) 


^ 
(2.37) 


as well as 


(12"*! + |a) (al @ (V — 1) & |b) (b) 
19"+" + (la) (a]) ә (V — 1)' & (|b) BI)" 


Em 


1?"*! + Ja) (a| & (V* — 1) & |b) (P. (G.119) 


With this we obtain 
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(ie +|a) (al @ (V — 1) әр) (bl) е! + |а)(а|® (V —1)® 0) 
= = + [а)(а|® (v* = 1) ® 0) са + |а)(а| ® (V — 1) ® (ы) 
(G.119) 
19"*1 la) (a| e (V — 1) & |b) (b| 
+ |а)(а|® (V* — 1) @|b) (b| 
+ |а)(а|® (V* — 1) (V — 1) &|b) (b| 
18m 4 а)(а|® ((V* 1) (V 1)-V y* 21) ау | 
— 18^ РІ 
м 
(0.118) 


Solution 5.60 First we show (5.15). Per definition one has 


AM (V) = 182+ |1) (118 (V — 1) 
—1681-4 |I) (I| GV —]|I)(1| 81 
= (|0)(01+1)(1]) e1- |Dü] ev —|1)(1|®1 
= [00008 14- |1) (1| GV . (G.120) 
The proof of (5.16) with projections |0) (0],... is a cumbersome writing down of 
many terms and lengthy. A more concise alternative proof can be given if we use 
the matrix representation in the computational basis. In this one has with (G.120) at 


first 


!(x) = [0)(0|814- |) ӘХ 


(ов (01) ene (to) 
= (оа) 2 (02) (0) е (1o) 


1000 0000 
_ {0100 + 0000 
~ 10000 0001 
0000 0010 
1000 
0100 
= |0001 (G.121) 
0010 


Analogously, we have 
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(G.122) 


and 


1 1 1 1 11 
e2. + d 
не (ч) яі) 


jd 11 

b 1-4 3 -1 

S PENNE (G.123) 
1—1—11 


With (G.121) and (G.123) one then obtains 


11 1 1 1000 11 1 1 
1|1—-1 1-1 0100 1-1 1-1 
92 41 Q2... m 

жаа ^ 4|]11 -1-1 0001 11 —1-1 
1-1-1 1 0010 1-1-1 1 

1000 
ooo1] _ 
0010] s~ 
0100 (G.122) 


The proof of (5.17) is simpler in the operator-representation. With (G.120) it 
follows that 


(0|&1-- |I) (116 М(о) 
(0|&14-|1)(1| eei^1 
= (0)(0] - &^|1) (1) @1 = P(a) @1. 


Solution 5.61 Since complex numbers can be multiplied to any factor in a tensor 
product, that is, since for any c c C 
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Әс) @---@|P) @---=---@|W) ®---®с|ф)®... 


holds, one has 


0 
s Q м) 
l=n-1 
= |Wn-1--- Wj+1) 6 [0)(0|w;) @ уу... Via) S |0) (O] Wi) 9 | wii --- Wo) 
t [Wai ja) Әу) ® Цу... Wit) 9 [1)(1] We) 9 [Via --- Wo) 
Wai ы) Ә |0) 1] Wy) @ [Wj-i-- Vie) 8 | D (wi) @ |у. . Wo) 
t Wai W1) Ә 0 (Оу) ® [Wi-i--- Via) 90) (1]wi) S Wei --- Wo) 
= |а... Vini) ® 10) (Ol We) S |у. Vier) 9 0) (0] wj) | War --- Wo) 
+ [Wi Vj) Ә 110) wo) 9 [vj-i-- Vie) 00) 9 | —1... Vo) 
+[yn-1 Wi+1) 8 |0)(O] Wa) @ [Wj-i-- Vie) 8 | D Iw) 9 Wei Wo) 
Wai ун) 9 D 1] We) @ Wii. Vie) ® 10) (O] Wy) @ [Wei -- Wo) 
= |Wn-1--- Vj) 8 10) (Оук) & |у.) ӘМ) ® | Wicca --- Wo) 
+ [Wa-i--- Vj) 8T) wi) © |у. Wie) 9 wj) 9 ia --- Wo) 
= уа... у) ® ЧИЕ) 9 |Wj-i- We) @ ЦУ) @ икт. Yo). 


This proves (5.31). From that (5.32) follows since the second application of 8) 
reverses the exchange of the qubits |y;) and |y;). 


(n) acts only on the 


factor spaces 19, апа Hp, it follows for j,k ¢ {1,m} that cs = S. prov- 
ing (5.33). For the same reason, (5.34) follows directly from the successive applica- 


tion of the CHR in $0). 


As ї acts only on the factor spaces "H; апа “Н, and S 


Solution 5.62 For the proof of (5.46) one obtains from Definition 5.18 that 


Ty V) Дәр) QV) 


2n—1 
=, | X 901+ voolx) Gd + voile) l+ violy) (al + viu) ol 
(5.44) 


2^—1 


Taking into account that vectors of the computational basis |х) and |у) satisfy (x|y) = 
буу, this then becomes 
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20-1 


Tg V) Tay (W) = È 190 


z=0 
z#x,y 
(voowoo + vo1W1o) х) (x| + (voowoi + voiwii) |x) (У| 


(viowoo + V11 10) |y) x] + (viowoi + Vi W11) Ly) Ol 
2”—1 

= У kel 
z=0 
z#x,y 

+(VW )оо |х) (x| + (VW)o1]x) (| 

+(VW) oly) l + (VW) ly) (| 

= Typ) (VW) . 


Ww 
(5.44) 


To prove (5.47), one uses that the matrix representation of V* is given in the com- 
putational basis by 


ү* = = m (G.124) 
vol V11 


and that |a) (b|* = |b) (a| holds. With this we thus have 


Ту) (V) 
2"—1 
zs У, (10) 2D + (уоо|х) (xl)* + (vor lx) О) + oly) @)* + Guil) o 
(5.44) i 
2-1 
an У, 19 (4 + тоох) (Х| + Vorly) (х| + viol) (у| + vir) o 
z=0 
(2.32),(2.36) ey у 
= (У): 
(5.44),(G.124) 


In order to prove (5.48) we exploit (5.46) and (5.47) 


Тоу (V) Tio УУ = Ton (V) Tay (V^), — Tob (VV) = Tay py (1) 
(5.47) (5.46) 
1°". 
— 


(5.44) 
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Solution 5.63 Let 


2-1 2-1 
x= у xj2! < у yj2/=y 
j=0 j=0 


with xj, y; € (0,1) and 


Loi := {j € {0,...,2—1}| xj 20andy; = 1] = {hy,..., hi) 
Lio := {j € {0,...,n—1}| x; = 1 and yj 20] = (i... Kr) 


The set Loi cannot be empty since otherwise х < y would not hold. Set g? = x and 
for! € {1,...,|Lio|} 


lg) = 197^ e x e 195-1|gl-!). 
Then set for | € {1,...,|Loi|} 
|g! Lol y = 1®"—М QX Q qe | al) | 
The |g’) thus constructed start with |x), and, by construction, two consecutive ele- 
ments differ in only one qubit until all qubits in which |x) differs from |y) have been 


reset to equal the values for |y). The last element is thus |y). Consequently, the |g’) 
constitute a GRAY-coded transition from |x) to |y). 


Solution 5.64 Let 


2n. .]2m..] 
9) = У Y 9) әу) Нән 
x=0 y=0 


“ шү where we have made use of the computational basis in НА = "1%" and 
= ‘H®”. Then we have 


Pll? = (0/10) =, SAL Yol) WEAN Y Mula) © PBa) 
(2.4) de" ab 
=, X Yal) ® уН (2) 1а) e |b f(a)) 


(2.6) x,y,a,b 


У Фу Ta (xla) (y Sœ) bH f (a) 


x,y,a,b 
(qug Sua 


=, È Жу (у(х) [ЬЕ f(x). 


etm 


(3.24 


Now, 
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(УВВ f (x)| b B8 f(x) 
(Yn-1 оо ftia E EAO 


п—1 


(yj Ф f(x) Б; Ф f(x) j) 


0м 
Gu) =ô; b; 
Z бу» 
(3.24) 

and thus 


По, = У ol? = 191 
х,у 


for any |) € НА & H^. It follows from (5.7) that U is unitary. 


Solution 5.65 To prove the claim, it suffices to show that UU, maps any vector of 
the computational basis in H®*4 onto itself. This can be seen with the help of (5.97) 
and (5.99) as follows: 


иги. (Iss) © |а) © [x1) ® һ)) 


2 2 2 2 
E и: (хоба Q хә) Ө xix © x3) 8 |x1 © x2) & [xi) &  ) 
~ eS eae, 


=x, =x 
2 7 2 2 , 2 j 
= ‚|( 9 x1)? © x1 6 33) & |х © x2) 8 px) @ |xo) 
(5.99) 
2 2 2 2 2 2 2. 
= |(%0 xi) ui Фәх) © x1 6 xoi © x2) Ө xix2 Ө x3) 
——^ м ——— 
=X =x4 


2 2 
|х © ху © x2) ® |х1) Q |xo) 
< 
=0 


2 2 2 2 2 2 2 2 
= |(xox1 © xoxo © x1 Ө хіх © x1 © хох © xoxo © xqx2 Ө x3) 


®|хә) & |ху) & |xo) 
= |x3) 9 |x2) & |x1) |х). 


Solution 5.66 From Definition 5.48 it follows that one has for an arbitrary vector 
|u) of the computational basis 
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1 on = 1 Qn _ 1 


хи 
Еи) = ~ ех (2227) x = ex (2277) x). 
№ = зт X exp Qnis) O le) = зт У, exp (ni) h) 
| hn 


For arbitrary vectors |u) and |v) of the computational basis this implies 


] 2—1 2-1 
(FulFv) = (У, ехр (2277) Ix)| Y, exp (2277) )) 
Qn’ 24 2 5 2 
2"—1 
уу = xu 
=> on У, exp (т 5s )ы ) 
(2.4),(2.6) "7 x 


[ 
"| 
N 
Mr 
о 
"< 
"3 
ы 
N 
a, 
= 
" 
Ми 


1 if u—v 


n 
= 1 (exp(2zi t)? EE 
empate) 0 uer 


= 8. (G.125) 
For arbitrary 
on On. 
= У ow) and |у) = У у) (6.126) 
и=0 v=0 
in ЯН®"” thus 
Pa 1 2h _ Ji 
(Fo|Fw) =, У, ew (Fu|Fv) =, У, aw = (olv) 
(G.126) ^0 3, (С. Gasto (2.1 21) 


holds and by Definition 2.9 F is unitary. 
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Solution 6.67 We show this by induction in n. For n = 1 we have 
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|x) = Н|хо) 


1 РА 
yg com) 


(2.162) 


p» |у), 


EP 
which proves the claim for n = 1. Suppose then the claim is true for п, that is, 


js 
H®™” |x) = p» c ту) (6.127) 


holds for a given n. For |х) € "Н"! we use the notation |х) = [x,...xo) = |х) & |X), 
where |) € "Н". Then it follows that 


HTx) = Нь) ән" 
1 22 —1 2 
= Hb). Y DO) 
(G.127) у=0 
1 X; 1 =, XOy 
5 Fell + Cyl) ск. 
(2.162) y=0 
1 25—] „2 „2 
= oy >, ((-1)"|0yn—1 .. 0) + (—1)**#®Ў|1у„—1...уо)) 
1 2n*l..| | „2 
= o } (CDO у,_|...уу) 
23 у 
1 2n+1_] 2 
= xr d CYP), 
223 y=0 


2 
where in the last step we used that a,b € {0, 1} implies (—1)4^^ = (—1)°®°, Hence, 
the claim holds for n+ 1 as well and the induction is complete. 


Solution 6.68 Because of (2.76), one has 1 = 12 = o2 = 02. With the definition 
of the PAULI matrices (2.74) and (2.35) one can easily verify that 1* = 1,07 = 
04,07? = о; and thus 


* 
0.0,(0.0,) = 6;0:0;0; = 0.020. 
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Hence, we have that for every U^ € {1, 04,04, 0404} then U^U^* = 1^ holds and 
consequently, 


(v^ 1") (ver) = (v^ e1") (v^ 81”) 


= (v^v^ a1) = 14 918 
1^. 


Furthermore, one has 


(a @1")|@*) = E or") —( 


г. (ойо) 210) + e) @|1) 


(00) + |11)) 


-5 
= aye 811) = 
= 17%) 


) 
(19 + 101)) 


and 


(oto; &1)1o*) = (oto: әл) (lo) «1 


(c? сд|0) @ |0) + оо; Ае) 


= z(a 1&0) +0410 &|1)) 
== (- 1) @|0) +|0)@|1)) = (en -110)) 
=|"). 


Solution 6.69 Let г be the period of the function fp y (n) = b" mod N. Definition 6.7 
then implies that we have for all n € N that fp y(n +r) = fo n(n) holds. In particular, 
for n = 0 it follows that 


Б modN = fy (04-r) = f,v(0) = 1. (G.128) 


According to Definition D.20, the order ordy(b) of b modulo N is the smallest 
number that satisfies (G.128). This implies 


r > ordy(b) . (G.129) 
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On the other hand, we have for all n € No that 


fon(n+ordy(b)) = Б") mod N 


p" (badn (b) mod N ) mod N 


(D.20) 
=  b'modN 


Кр 
Def. D.20 


= Јьм(п). 


Since the period r is the smallest number with the property fy (n + ғ) = fo, (n), it 
follows that 


r X ordy(b) . (G.130) 


The claim r = ordy (b) then follows from (G.129) and (G.130). 


Solution 6.70 Choosing an ONB {|®o) = |¥%),|®1),...} in H^ @ HË which con- 
tains |3) to calculate this trace, we obtain 


tr (I5) (5| (Iz) (cl  17)) = E (Ф198) (I (Iz) | 17) 7) 


j 
(2.57) pa 


= (%|(Iz)(z|@17)%) (G.131) 


Since the projection (|2) (z| & 1”) has the properties 


(1944918)? = aeaee (6.132) 
ЕЧ 
(о) z]) 918 


(I2 &15)" |) (1918, (6.133) 


wy _— 
(3.31) (2.36) 


we have 


(%(д(@®1°)%) = (isl (I o 15) H) 
(G.132) 


(12) el & 1)" 9^] (Iz) (z| 15) 95) 


(19 2] @ 17) 5] (lz) (z] @ 17) ч) 


= || (Iz) (1 e 15) |¥%) ||” 


(2.5) 


(G.134) 
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and inserting (G.134) in (G.131) yields the claim (6.45). 


Solution 6.71 If = =: т € N holds, it follows from (6.36) that 


1 
1 |m- oni 
r 


as well as from (6.37) that 


211 
к=2®-1тойг=2%-1-| 
Р 


| r-22Lb—-1—(m-Dr-r- 1. 
Furthermore, with (6.38) we have for all k € N with 0 < k < r— 1 = R that 
Jy —J—m-1. 


Inserting this into (6.46) this yields 


эт X ‚т? ЄЙ 
W(z) = eim 2 
ix 1 gr else 
2 
2L ez 
(2) ем 
0 else 
 [liif£eN 
~ | O0 else 


Solution 6.72 For n € No we obtain, by equating the imaginary parts of the left side 
to the right side of 


А r n 
сов(ло) +isin(na) = e"* = G = (cosa+isina)”, 


that 
DC 
sin(na) 2i ) cos?! g sip?! с. 
21 21+ 1 
From this we have 
E 


sin(n . 
cos”?! æ sin” gy 
sin & 2 Ds +1 
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and also obtain 


sin(ng) V _ E if ” п—21—2 y çi 21+1 
кз = ¥(-1) 241 (n — 21 — 1) cos asin’ ™ a 


n 
21 п—21 a - 21-1 a 
2 14 ) cos sin 
as well as 
sin(na)\" R (оп -2-3 12142 
= —1 21—1 21 — 2) cos" asin” о 
( ina ) 2 ) Jai (n )n )cos sin 


[v] 
L 


(n — 21 — 1)(21 - 1) cos" 2/1 æ sin” y 


NIS 
П 


21(21— 1) cos" 2+1 @ sin”? gy 


ll 
= 


= 
П 


21(п — 21) cos" 217! g sin?! о. 


T 
© 
бо у» EE C S 
i 
T 
к= 
ы” еы M Жы” чы 


ll 
к 


At œ = 0 one thus has 


и е 
sing !®=0 
sin(na) V 
( eu ) [о = 0 (G.135) 
sin(na) Y" n 2 
= —(1—п°). 
( sin 0 ) la-o 3 “ 
In s(@) = 60) we have J, € N and Jj = +12 > |22— 1] > 1 since 
we can assume L > 2. Hence, it follows from (G.135) that 
s(0) = J 
5'(0) =0 


(0) = 401-8) <0, 


that is, s has a maximum at @ = 0. That s has no further extrema in JO, 7777 | can be 
seen as follows. First, we obtain by explicit computation 
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Л, cos (o. J,) sina — sin (a f;) cosa 
5'(о) = — (Л) ый (07) | (G.136) 
sin’ & 


If oJ, = 5, it follows that s'(œ) < 0. This value is then not an extremum. Suppose 
now that œ €]0, stel and aJ; + 5. Because of (6.51) and (6.52), one has then 


a< i 
2541 
~ T T 
аЛ < = + т. 
| 2 25+1 


This implies that in the case «Л; « x as well as «Л > Е 
tana < tan(a fp) 
holds and thus also 
(Ji tan x)! = Л(1-кїап^ à) < Л (1 + tan?(o;)) = tan(a f) . 
This, together with Л, tan |g—o = tan(aJ;)|a=0, yields 
J, tana < ќап(о) 


and thus 
Л, cos (afp) sina < sin (Л) cos a. 


Because of (G.136) the latter is equivalent to 5' (0) < 0. This completes the proof of 
s'(@) <0 for æ €]0, 5017]. Since s(—a) = s(a), it also follows that s'(œ) > 0 for 
o € [- 575, 0|. In the interval |— 5777, эгүт] the function s(œ) thus takes a maximum 
at œ = 0 and decreases to the left and right of œ = 0. Hence, inside the interval 
it is greater than at the boundaries +577. Due to 5(—0) = s(@) we can choose 


Onin = srr Finally, one has in the given interval that 5(0) > 0 so that there also 
s()* > s(Qmin)* holds. 


Solution 6.73 Per Definition 6.15 we have 


fhidesH — & 069 f(m)-f(m) e gj le К 


and since 


698 Solutions to Exercises 


hc9(: gi'go=h 
he: g2= gh 
е, gsH=gik 


the claim (6.88) follows. 


Solution 6.74 For any g1, g2 € 9 we have 


1 
А А _ _ 
ы) cl У > (ki |k2) =й, у у ба. 
1 1 


(6.9 Є[#1]‹ o €lgoloc (6.89) €[ei]oc o €lez]oc 
(G.137) 
From Lemma Е.20 we know that the two cosets [gi], and [62] are either identical 
or disjoint, such that 


x Au ЕЕ: 
ky€lei]gco€leo]ac 
— Уде] | df [21]5c [82] 
0 if [sils F [82] 
JIH) if [sils = [sale (G.138) 
О if [81] Z [slx 


where in the last equation we used Theorem F.21, which tells us that the number of 
distinct cosets of H is equal to |H]. Inserting (G.138) into (G.137) then yields the 
claim (6.101). 


Solutions to Exercises 699 
Solution 6.75 To prove the claim, we have to show that H as defined in (6.115) 
satisfies the requirements of Definition F.6. Clearly, this set H is a subset of 
S = Zy X Zy. With the choice и = О it also contains the neutral element eg = 


([0],7 . [0]. 7) of that group, verifying (F.14). 
For апу two elements (|ui]yz ,[-dui]yz) € H, where i € {1,2}, we have 


([uilz ;[7dui]z ) +s (wala 1-40] ул) 
( [u +Zy из] yz> [-4ui +7 (-du2)]wz) 


( [Кш + u2) mod N] yz , | (dui + дил) mod N] yz ) 
( [ui + u2]yz ›[(—4(и1-+Е u2)) mod N] yz) 


( [ш + u2]wz , [(—4(и\ + uz) mod N) mod N]y; ) 


la +0]: [(-d(u1 +2y ш)] yz) € H, 


proving (F.16). 
Lastly, for any [u] yz € Zw we have that ([u] yz , [—du]yz,) € K, and that its inverse 
([-u]yz › [du]yz) is also an element of K, verifying (F.15). 


Solution 6.76 From (6.119) we know that any x € H+ is of the form X4; moa Nn- 
For such characters we have for any ([x|yz .[v]yz) € 9 


Хаптоамл([ мл Ума) = e” нон» iri _ (entry 
' Кр 
(6.117) 
n 
Ку (aa (dz. blz) 


(6.117) 


Ау xa. (vz А Улз) ; 
(Е61) 


which shows that every element of H+ is some power of yq.1, implying H+ = 


(Xaa). 
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Solution 6.77 We infer from (6.75) that 
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Х = { (теу, Я [-3т] 6з) є 26 х 26 | [ml 6z Є 26} 
= { ([Olez E LO RAE (Hez Д Blez) ([2]ez ’ ez): 


and from (6.119) that 


(Blez ’ (3]62), (lez ’ (lez): (Slez И [3]62) j 


= Zo х Zs | [n]ez € Ze) = {X0,0; %3,1, 0,2, X3,3 04:255] - 


For these characters we find 


With 


we also have 


х N 4 о = 


BR 


lez) € Ze х 26 | [3x+ylez = 0} 


W 


3 
1 


62), 


62), 


ez) } 


62), 


62), 


62), 


62), 


62) } 


62), 


0162), (16, Blez) (lez lez), (lez Blez)» 
Olez)> (lez: Blez) } =H 

ylez) € Ze x Ze | [2y]gz = 0} 

lez) (Hez Blez) (lez (lez), (lez. 
Olez), (1512, Blez) (10162, > Blez) (lez; 
3]ez). (Blez: loz); (Hez: Blez) ([5]5z . 

ylez) € Ze x 26| [9x+3ylez = 0} 

Olez), (Hez [B]l6z); (lez: (lez), (lez. 
0157), (15762, Blez) lez» lez), (Hez: 

Zez Ї2]вл,)› (Blez: Шол), Mez: 12162), ([51sz ва) ) 
lez) € Ze x Ze | [4y]gz = 0) 

Olez), (lez Blez) (2162, 1062), (lez; 

Olez), (512, Blez) (10162, > Blez) (lez; 

3Jez)> (Blez: [0loz); (4162, lez), ([5lsz ; 

2162) € Ze x 26 | [9x + 5y]gz = 0} 

0]62), (lez Blez) (lez: 10162), (lez 

072), (Slez: Blez) } =H 

(bez lez) е еН) 
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Хоо([ ву, ›[У]вх.) = 1 = (Хзл(Хж, У)" 
X34 (Ddaz ; Nez) = e" 3) = (%31 (Ddaz ; lez)’ 
Xo3(bdaz ; ylez) =e"? = (a (Ddaz ; ЖЫ) 
Хз зл Dez) = ene (xs (dez: by m) 
Хо4(1162› Ува) = ens = (asa (lez D B 
43,5(Pl6z> 0162) = npe) (x31 dez > ye) . 


confirming (6.120). 


Solution 6.78 To calculate the trace in H^ we use that, because of (6.113), we can 
utilize the basis 
Un els) 


r,s € {0,....N—1}} C H^ 
such that 


tr (P, Fap^ F3) we У (ғ95|(Р,„Ғәр^Е)ғ®з) 
(2.57) nse(0,....N—1) 


(rlu) (sl) (и ® v|(Fap^F3)r& s) = (u& v|(Fgp*F3)u® v) 
nse(0,...,N—1) УМ 


{i 
м 


1 j ety 


= э Ж е" (n7? (ujdn mod №) (dm mod Nu) (v|n) (m|v) 
(6.122) elc e8/2€ = 
ШАША 2 =ӧһ =блу 
2 
Ж... Se. o 
N? 
(815: €9/3€ 


1 
= 5 5 |(uļdvmod N) | 


(25:€9/3€ 


_ |(u\dv mod N)|? _ 
S/H = 


N2 
(F.36) 


|(uldvmodN)| [9] 
N? [c] 


| (u|dvmod N)? 


Ww N 
(6.111),(6.116) 


Solution 6.79 For the proof of (6.152) note that (6.149) implies 


sin = 5 and cos@) = i (G.139) 
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It follows then that 


p 1 
%) =, — У 0) = HS (Мм-м) + vm Y 
10) ILE = z (V |51) + т) 
138) 
= ‚ cos o| 5.) + sin09| V^) , 
(G.139) 


proving (6.152). 

Since ||| = 1, the projector onto the subspace Hsub = Ѕрап{ |) } is Pub = 
|'%) (96|. Consequently Ry, as defined in (6.150) coincides with the definition of a 
reflection about |o) given in (6.147). 


Solution 6.80 With 


Zita 4 е-102/+1)а еі ji j еті i j 
cos((2j+1)a) = E (е ui +(e “| 
(Qj-- 1)a) - ; 5 
we obtain 
J-1 iœ J—1 j —ia J—1 j 
. e 2iq VÀ © жол! 
cos((2j -- 1)о) = — (е): + (е ) 
Lota P Y, > 
j= j= j= 
—— 
1—ei27€ 1—-e-i27€ 
= 1да — ie 2a 
ela 1— еі279 eic j= e Ja 
© 2 1-ебо 2 Tee 
ea e Va EN ea e Va ea EM e Va 
= 2 е—1®_ ela + 2 ei* _ e—ia 
ea + e Va eva _ e Va 
m 2 ela — e—ia 
sin(Ja 2cos(Ja) sin(Ja 
= cos(Ja) ( ) = ) ue 
sino 2sina 
| sin(2Ja) 
С Qsina ` 
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Solution 7.81 Recalling from (7.1) that for a,b € F2 
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0 ifa=b 


p 
+r, b — aO b= (ad b) mod2 = 
ub due en?) f ifatb, 


the claims (i) - (iii) are obvious. To show (iv), consider 


E. 2 2 
dg (u, v) +dy(v,w) — dy (u, w) = У uj Pvjd vj DWj-Uj Ф иу, 
j= 
=:ај 


2 2 2 
where u; © vj,vj 6 wj,uj © w; € {0,1} and thus for any j € {1,...,k} 


uj—wj; > ajz0 


© 


uj FW; and uj Vj Vj Wj aj 


uj Aw; and uj vj vj —wj aj — 0. 


Hence, we obtain dj (и, v) + dg (v, ж) — dy (u, w) > 0. 


Solution 7.82 


(i) Recall that the kernel of any linear map F : V — W between finite-dimensional 
vector spaces V and W is defined as 


Ker(F) = {we V| Fw=0}. (G.140) 
For апу w € F% it follows from (7.8) that Gw € Ker(H) and thus 
HGw = 0, 
Ww 

verifying that HG = 0. 
(ii) We use the following result from basic linear algebra: for any linear map F : 

V — W between finite-dimensional vector spaces V and W we have 

dim ЕУ} = dimV — dimKer(F). 
Applying this to H : F} — pr we find 


dim H{F5} = dim F} — dim Ker(H) n—dimG{FS} =n—k, 


cT 
(7.8) 


where in the last equation we used that per definition С is of maximal rank К. 
(iii) Let 
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hy, 
where the h; € F} for j € (1,...,n — k} are linearly independent. Define 


s- [mtis i=l 
"e EE (G.141) 
h; TAR 


Then the h; are linearly independent. To prove this, suppose а; € IF» for j € 


{1,...,n—k} are such that 
n—k 


n—k 
0= Y ah; = 2i (ha o) а 


= aih; + (a) + az) ho  a3ha +- +: a4 4 4. 


Since the h; are linearly independent, we must have a; = ај + a? = аз . 
n — k}. Thus, we 


аһ—к = 0 from which it follows that a; = 0 for all j € {1,.. 
have shown that 
n-k _ 
0 Vjc(0,...,n—k], 


Y ajh; 20 > а; = 
j=l 


which means that the h j are linearly independent. Therefore 


ce 
h, , 


has maximal rank dim H (F7 }=n— k, and we have 
(G.142) 


dim Ker(H) = n — dim H {F2} = k = dimKer(H). 


Moreover, 
У (һ)ш=0 Vvje(lL...,n-k) 


u€ Ker(H) = 


> X)m-0 Yje{1,... n-k} 
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which implies Ker(H) C Ker(H), and together with (G.142) this gives 


Ker(H) = Ker(H) 


Consequently, Hisa parity check matrix as well. But H cannot be equal to H 
since this would require һу = h; and (G.141) shows that then hz = 0, which is 
impossible since the h; are assumed linearly independent. 


Solution 7.83 For any a,b € F5 we have 


2 2 2 2 
syn,(a $b) = H(ao b) = Ha Hb, = syn,(a) © syn,(b). 
(7.11) (7.11) 


Solution 7.84 Evaluating the encoding map for a |y) = a|0) + b|1) € ЇН with a,b € 
C, we find first 


Anly) = Ai ((al0) +5)1)) &|9)*) 


57 
7.30 
= (In e19?esxe1?exe 1) ((alo) +b|1)) 8 0)") 
(7.31) 
+ (|0)(0] 159) ((ајо) +41) &19)*) 
= al0)? +b|1) 8 |0)°® |1) ә |0)? & 1) e |o? 
= al0)? +(\100))*, (G.143) 


where we used X|0) = оу|0) = |1). Next, we have 


Ay) = (H@1°)°? (410)? +.6(|100))**) (G.144) 
(7.31),(G.143) 
|0) + |1) 2 (2° 23 
= elo?) +b ®|0 
= «(EX e ZI 
(2.160),(2.161) 


and finally, 
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AaA2Aii|y) 
(I a] ex ex + |0) (01912) 


с еве) ow)” 


3 
= « (X )(1|®Х @X + |0) (0| e 17?) (EX & [0) gr 


3 
-b|(I)üjexex + |0)(0|®1®?) (BD atr 


u " @2 
= (@ (1[8X 8X + |0) (091%) Ja 


b a @X @X + |0) (019182) 


|000) + ко =з 


1000) — |100) | e4 


v2 
Е «(0 | (pom) 
i v2 | V2 
Solution 7.85 In the following we use that 
(01) = 0= (10) (G.145) 
lo(|-|Dü| = 1 (G.146) 
x? о? = 1 (G.147) 
2.76) 
H = 1 (G.148) 
м 
(2.163) 


Therefore, we have first 


A} =, (ID1181? ex o1? әх @1™ + |0) (0| e 195)? 


(7.31) 
= (|1) (191% 9х 91% 9х 9182)? + (|0) (019188)? 
(6.145) 

„=, ШШ 1% + |0) (01 @ 1*5 = (11) (+10) (0]) & 15* 
(8.147) 
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апа Шеп 

@2) 83 2\®3 (2 21893 _ 3463 
н%1®^ (нот) = (Н°®1°®°) ey 
(7.31) (G.148) 


Finally, we obtain 


43 =, (ID exex--J0)01e19?)?* (1118X ex +0) (0] e17?)** 
(7.31) 
= ((1)(1{®Х?®Х? + |0) (0| e 192)*? = (|1) 1] @ 122 + [0) (0| @ 1229? 


(G.147) 
= (({1)(1| +0) (0]) @ 12)? = (13) 
(G.146) 


= 189. 


Solution 7.86 Keeping in mind that the Uz, are just complex numbers, we have 


БИ 


€, wy 
(7.41) 


m Ы т т 
(5 Оа es) = LW ab Ep)” = Uab © 
m 
= YUL8. (G.149) 


(2.3 b=] 


N 
io 
$ 
— 


which implies 


b 


Y&p, NE у (5 Uab J p (x Uca e) 


py (3 UU) Epp & = x (UU Jeo Epp & 
b,c Бс 
= 0сь 


= x p 
D 
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and similarly, 


Solution 7.87 As quantum operations, S and T are convex-linear, and we have for 
every Q1, p2 € D(H) and и є [0,1] 


S(upi  (1— u)p2) = uS(p1) + (1 — u)S(p). (G.150) 
Ei (e 
T za) =e Vp € D(H). (G.151) 


Using the operator sum representation for T with 7; denoting the operation elements, 
we have for any p € D(H) 


1 bo S) x = 5(0) _ 
misty 48017 = ET O T (eio) ^ | 
which implies 
У ns(p)T; —tr(S(p))p. (G.152) 
1 


Consequently, we have for any pi,» € D(H) and u є [01,] 
7 ( _S(upit 710p) 
tr (S(upi + (1— u)pz)) 


uS(pi) + (1 — u)S(p2) 
à (asp +(1 se) 


ир1+(1—и)р =, 
G.I51 


=> 


) 


Чор 
G.150 


" uS(pi)) -(1—-4)S(p2). „s 
E asi) + ( —и)3(рә)) 1 
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A X, T)S(p1)T + (1— и) X; 15(р2) Т“ 
ші (8(01)) + (1— ш) tr(S(p2)) 
_ gtr(S(oi)) pi + (Y — ш) tr(S(p2)) po 
mx PESES) 
which implies 
tr(S(p1)) 
^ (ccs s илгэ у; 


_ tr(S(p2)) 
== ( xS eG) 


Since p, and p» and и є [0, 1] are arbitrary, it follows that the terms in the paren- 
thesis have to vanish from which it follows that tr(S(p1)) = tr(S(p2) and thus 
tr(S(p)) — const as claimed. 


Solution 7.88 


А-А) =, (Аи (iv) у Ау - (viAv)v) 


— 
N 
Un 

— 


=,  AwlAy)—(wlAy)(Avly) - (Aviv) (v|Av) 


(2.4),(2.6) 
t (Ау) ИАЦ) (|у) 

_ _ 2 m 2 
=, (АМАМ) -iaw Q— 1) 
(2.6) =1 

— * 2 

=, (МАА) – (vlAv)| 
(2.31),(2.30) 


Solution 7.89 The claim < is trivially true. To prove =, let 


а: SL — C 
ly) = (Ау) 


and for all |y) € H with ||w|| = 1 let 


Aly) = а(|ци)) |у). (6.153) 
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Moreover, for i € {1,2} let |w;) € H be two linearly independent vectors satisfying 
Пу = 1, and let 21,22 € C with 222 Æ 0 be such that ||zi|wi) +z2|Wo)|| = 1 as 
well. Then it follows that 


А(а|ул) +22|W2)) = Cava) + о1о) ily) +оо) (G.154) 
(G.153) 


Since А is a linear operator, we also have 


A(zilyi) +оо) = aA|wi) оАо) =, Aly) wa) + a(1wo))e)]wo) 
(G.153) 
(G.155) 
Equating the right sides of (G.154) and (G.155) and using that the |y;) are linearly 
independent, it follows that their respective coefficients have to coincide and thus 


a(|wi)) = aa wi) +22|W2)) = a(|y2))- 


This implies that 2 is constant on the unit sphere S}, that is, a(|y)) = const = a € C 
and thus 
Aly) = ајр) Vly) € Si. (G.156) 


But then for any |p) € Hx {0} we have that 4 € Sl, which implies 


А19) [2 


loll =~ “Toll 
е (6.156) P 


, 


and it follows that А|ф) = a|q) for all |p) € H since this is also trivially true for 
|p) = 0. 


Solution 7.90 We first show that there is a g € Ло with wo (g) = 3 such that 
(0191) Z 0 = f(g)do1, where the basis codewords |Y) and |) are given by 
(7.33). For this consider 


в = (1? 927)? -1919Z281919Z9191GZ, (G.157) 
which satisfies wp (g) = 3. Noting that 


(1°? & Z)|000) = |0) & |0) & Z|0) = |0) & |0) & |0) = |000) 


T (G.158) 
17*82)111) =) 910 41) = 1)®[1)®(—[1)) = -|111), 
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we obtain 
23 
= 92 @3 1000) — |111) _ 
gu io 4 92 ( v2 
(G.157),(7.33) 
е, = (Ens tm" 
— 
v2 eie У 
= 190). 
(7.33) 


Therefore, we have 


dg € Фә: wo (g) —3 and (0) = (0%) = 1 #0 = f(g)ópi. 


It remains to show that for any Л € Po with wp(h) < 2 and x,y € {0,1} we have, 
instead, 


(FIRE) = А) дь. 
We do this in two steps, first addressing the case x Æ y, and in a second step we 


show that it holds for the case x = y as well. To begin with, we note that with £7, as 
defined in (7.43) any h € Po with wo (A) < 2 is of the form 


h=i > >, (G.159) 


with c, с, B € {0,...,3} and j,1 € {0,...,8}. We also introduce the following intu- 
itive and helpful notations. 


„— 1000) 2-111) 3 
|W) к=? V2 ЄН? 
93 
== (MO је 
- 83 
jou = (E97 Py yos. 


For j € {0,...,8} we set j := H and j :— j mod3. Therefore, we obtain 


zip) = 85 (xdv) ew) Гуа) 
+5 ly) ® (ха) ә) (G.160) 
+ б) ® lw) ® (ха). 
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It follows that | 
(IEPER E) =0 (G.161) 


since, due to (3.4), each of the nine scalar products formed by using (G.160) in the 
left side of (G.161) will always involve scalar products of tensor factors in H®? of 
the form (y. |y.) = 0. Hence, we have for any h є Po with wy(h) < 2 that 


(РК у =, (Д) |Б) 
(G.159),(G.160) (2.4),(2.30) 


ix, [xp 0 


(6л) 


hes cl 
(zi =z} (G.161) 


= f(h)601 


Finally, we show that for any Л € Фо with wp(h) < 2 we have (|А) = f(h) = 
CPi |h3). For this note first that 


(хб |р) =, бра) (9.162) 


(6.160) 


+(1—бу)(®й у ws) (e| E] з). 


Here we have 


(ws | X5 уз.) 
_ i i TN Iain ur i 
= 5 (000012000) + (11115111) + (000/5111) + (11114000) 
(G.160) 
1 2 2 
== 01680) + (1]og1) £(0|6g 1) (011) £(1}og0) (1/0 
Se 3 | (91980) + Lop ыы 1) (011) £(1|o0) (10) 
= бро. (G.163) 


Likewise, we obtain 


(Ed V. | уз.) =, ((24)" үз. | Eg Ve) sae Zp We) 


1 Y у ү у 
5 ((0001х2 2000) + (111.5425 111) 


(0002225111) + (111/2424000) ) | 
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where 
(000225111) = 5:7(0|oa0g1) (01)? +(1 — буу) (0/041) (0/651) (011) 
Ss’ М2 
=0 =0 
= 0 
and, similarly, GJE j000) = 0, such that 
Y Y 1 Y y үу x 
(Zyls y+) = 2 (0000152 2000) + auizizju)- Cup (G-164) 


Inserting (G.163) and (G.164) into (G.162) gives 


(ELELE Y) = бүбү 


J 


J), (B.D) +(1— ӧзу) даодво = Cia, j), (B,D) (G.165) 
such that, finally, 


“SY 
(G.159),(G.160) (2.4),(2.30) 


PSE EE) m ipw xu) 
(XL xi, (G.165) 

iC jy 1 ET 
PW |Z) =, 


y-zi (2.4),(2.30) 


(Hin) „=, ОР) =, i (24) EIERE) 
9), 


(9. [i DLE, ) 


Solution 7.91 From Fig. 7.6 we have 


A; = |1)(11[@1818X 81+ |0) (0191519191 
Ал =19|0(1919Х91+19 |0) (01919191 
Bı = |1)(1|818918918X + |0) (0191919191 
В›=1®1®|1)(1|®1®Х-+1%®1®|0)(0|®1®1 


such that 


АА! = |D) (1| 8]D) (1| 81691614 |1)(1]6|0)(0| 819 X 81 
+ |0) (01510) (1| 816 X 6 1 -[0) (0| 8/0) (0| 819161 
BoB, = |1)(1]@1@|1)(1]@181+4+|1)(1]@1@ |0)(0] o 19 X 
+ 10) (0] 816 |D) (1] 8 16 X + |0) (0| 816 |0) (0| 8161. 
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After multiplying out term by term in B2B,A2A, and using (0|1) = 0, (1|1) = 1 = 
(0|0) as well as X? = 1 we find 


$= [1 Це 
+|1 0|®[1 
+10 ЦӘ 


+ 10) (0| 10) (0| & [1 


1]@1@1+[1){1] @|1)(1] @ [0)(0|®1®Х 
1] @X @14+]1)(1] @ [0)(0| @ 0) (0/8 X 89X 
1] @X @X + |0)(0| ® [1)(1|®|0)(0|®Х ®1 
1|@1@X + |0)(0| ® 0) (0| ® |0)(0]®1%1 


— м wa wa 


(3.36 
“SN 


|111)(111| + |000) (000]) @1@1 
|110)(110| + O01) (001|) & 16 X 
|101) (101| + 010) (010]) 9X & 1 
|100) (100| + O11) (011) 9X & X , 


у. ire ei. н ee 


which is (7.109). 


Solution 7.92 Let h;,h» € Pn, and let gj be one of the n — k generators of $. Then 
we have 


(—1)## gh, — ов = h(-1)/02gj. — (—1)0)*502g ihih 
(7.122) (7.122) (7.122) 
such that 
2 
Lj(Aphz) = (101) +1j(h2)) mod2, = 1;(h) & Lj(R) (G.166) 
(5.2) 

and thus 

syny (Aio) =, (П(Лїһә),...,Һ—к(Лһә)) 

(7.121) 


Кур, (l (hi) ó lj (Лә), e. loh) à In—k(h2)) 


2 
= , synj(hi) © syn, (^2). 
(7.121) 
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Solution 7.93 Per Definition F.16 we have that h € N(S) means that AS = Sh and 
thus for any g Є $ there exists a g € $ such that 


hg — gh. (G.167) 
Consequently, for any |) € IHC« 


gh|P) — , hg), — hv), 


(G.167) 28 


which means that |У”) is left unchanged by the action of any g € $. But НС is the 
subspace of all vectors left unchanged by every element of $, which implies that 
h|V) є НС. 
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Solution 8.94 As per Definition 2.8, we have for any |y), |o) € H 


(WIA(s)@) = (A(s) vo). 


Consequently 
d 


S (viA()9) = (AG) wie). (G.168) 


The linearity and continuity properties (see Definition 2.1 and Exercise 2.5) of the 
scalar product allow us to pull the derivatives inside so that (G.168) implies 


А00) = C (46) vie) t (2 (89)) 0) 
(2.30) 


for any |y), |p) € H and thus 
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Solution 8.95 From (8.8) we have 


2 2 
> = = — — 
g^ > eee =(Ф—Ф|Ф—\Р) 
(2.5) 
_ 2 2_ Е БЫТЕ 
Ie mr = (Ф|) – ae) = 2—2Ке((ФИ\Р)), 
(2.5) (2.1) 
where we also used the assumption ||®|| = 1 = ||% || in the last equation. Thus, 
a 


Re((®|¥)) > 1-5 
with which we obtain 
(ФҸ) |? = Re ((®|¥)) + Im (Ф|)? 
>R 2 ey E 
> Re((®|¥)) >(1-®) mide ae 


> ae. 


Solution 8.96 For any computational basis vector |x) = |x,..1 ...xo) € "IH?" we have 


1 п—1 
Hini lx X? |x) = ( —2 у v) lx). 
(8.24) j-9 (8.26) 9 


n— 


Hence, each |x) is an eigenvector of Hini with eigenvalue 
п—1 
Enix —n-2 у Xj, (G.169) 
j=0 
where x; € {0,1}, and we can determine the eigenvalue Eini x by the number 
п—1 


l2n—Yx (G.170) 
j=0 


of the x; in |x) = |x,-1...x9) which satisfy x; = 0. The lowest such number is 
ln—1 = 0 with eigenvalue Ёш „„_ = —n and eigenvector |2" — 1) = |1...1). The 
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highest l, is |o = n with eigenvalue Ем, = п and eigenvector |0... 0). Consequently, 
the eigenvalues are of the form 


Eni 21—п forl € {0,...,n}, 


К 
(G.169),(G.170) 


and for a given / there are (7) distinct |x„—1 ...xo) such that / = n— = ixj. 


Solution 8.97 For any computational basis vector |x) = |x,_1 - - -x0) € "IH?" we have 


Hin = S jsi D |x) 
i=0 РЕ 
(8.24) le = 
п—1 п—1 . 
=, |$ A -23)0 22) Y, K( 20у) ect?" | |) 
(826) [425 j=0 


п—1 п—1 n—1 

4 У xiJijx; = 2 У (xiJij + Jijxj) EE У DES Tc lx). 
i,j=0 i,j=0 j=0 i,j=0 j=0 

L ig izj 62) 


Using (8.25), we obtain 


п—1 


ёк Jjxj -2 У ( xiJij 4- Jijxj) -25 Kaye Y, + DK +c 


i,j=0 i,j=0 i,j=0 j= 
izj izj ifj 
п—1 п—1 
Qij xiQi; + Ох) 
= 4 у Xi Xj 2 у 
i,j=0 4 i,j=0 4 
ifj ifj 


1 
=27, E È (Qij + Qji) – 39i |» 


п—1 Qi; n—1 1" 1 
1] 


TX 4*à -12.(QQu* Qj) - 20, 


i,j=0 =0 i=0 
à izj 
1 п—1 1l 
"73 >, Qit; У Оу 
i,j=0 j= 
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п—1 п—1 


= xiQijxj + x Ох) =, b xiQijxj + 2 Qiii = = Y xiQijxj 
i,j=0 j=0 хує{0, 1р“ mi i,j=0 
izj i 


Solution 8.98 From (2.36) we know that |P) (P |* = |P) CF] for all Р) € H and 
since f(s) € R it follows that Hini, Han and Ну (s) are all self-adjoint. 
By definition |||? = 1. Hence, we have for any |) € H 


ow? < ||Ф(? Ф Ф|Ф 
Ker. x | II^ I|? = [ep SAP|®) 
(2.16 =1 99 
and thus 
0 < (Ф|Ф)—|(Ф|)| 
=, (09) - (D|) (96/8) = (Ф|(1— (96) (l) 2) 
(2.1) 
LL Gai) 
(8.28) 


proving the positivity of Hini. 
To show this for Hg, we recall that any orthogonal projection P satisfies per 


definition P? = P and P* = P as well as from (2.55) that ||P|| = 1. Consequently, 
for any |®) c H 


(D|) = (PIPED) = (|P3Psd») = (5Ф\Р5Ф) = ||Р5Ф|? 
(2.5) 
2 2з __ 2 _ 
ПАФ — Ф| = (|o) 


< 
ad 
2.51) (2:55) (2:5) 


and thus 


0 < (Ф|Ф) – (Ф|РФ) = (P|(1— Ps) D) 
Ку (Ф|Нь.Ф), 
(8.30) 
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proving the positivity of Нал. 
As a consequence of the positivity of Hini and Hg, and the properties of the 
schedule f : [0,1] — [0, 1], we have thus for any |®) € H that 


1— f(s) (®|Hini®) + f(s) (Ф|НьһФ) 
n OO" TS 
(8.32) >0 >0 >0 >0 


f(s) «1 
- fJ3-5«3 


and thus 


which implies 


1 1. be bw 
танаа) (19-5) «1- f(s) 


—$— 1_—— 
=E_(s) 
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Finally, also using 0 < т < 1, we have 


f(s) «1 
=> (1—m)(f(s)* — /(5)) «0 
= ч-да -m (706) 59) » Р 
2 
= bs Satay (0-1) < 1 = (5) 


Solution 8.100 This is shown by a series of straightforward implications: 


0x f(s)<1 
> 0< f(s)(1— f(s)) 
=> 0x —m(f(s)? — /(5)) 
~ 2 
> 057 я (л)-5) 


2 
" го Mist - s (9-1) 
——— 
-i-E.(s) 
= 0x 1— f(s) — E-(s 


Solution 8.101 From the definition of P, in (8.60) and the definition of the ІФ, (5)) 
in (8.49) it follows that 


Рьь|Ф+ (5)) = |Ф+ (5)). (G.171) 


Hence, we have 


Hyp! P+(5)) Pa Hr (s) Pou] D. (s) P. Hr (s)] D. (5) 


_— 
(8.64) 


=, PawE+(s)|Px(s)) 
Тїш. 8.11 (G.171) 
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such that (E«(s)) C c (Hr()|s ) and |®..(s)) are two orthonormal eigen- 
vectors of Ну (5) 
lows that Hr(s) 


Bast But Huy is a two-dimensional HILBERT space, and it fol- 
su 


cannot have any other eigenvalues than E. (s), which yields 


Нь 
the claim Ux) E c (Hrs)lg..). 


Solution 8.102 To begin with, we have 


(Hên = Hini) ls. Psi (Hein = Нш) Pus 


= 
Pau (|%) CHo] — Ps) Pus 

|'Po) (61 — |1465) (P| 

(1 т) 6) (‘Pei |+ (m— 1) |5) (61 
+ /m(1— т) (|У) CPs] + [98) (Фе. |). 
Now let | V^) € Hu, with ||Ҹ 12 = 1, which means 


|) = а.) + DIS) 


with 
la? + |b)? = 1. (G.172) 
Consequently, 
(Has = Hini) |, pP) = (0 ma + Vm — m)b) Vs.) 
F С 1)b+ m(1 — т)а |) 
such that 


(1—8)a- mill o| 


| | (Hen — Has], I9) | | Ww | 
(2.14) 


2 


+ | i ЬУ mya 


= ((1— mi)? m ñ) (142-102) 
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Together with Definition 2.12 of the operator norm this then implies the claim 
(8.66). 


Solution 8.103 The claim is shown by straightforward computation. 


Aeg = 
1 —-(q)! 0 e 0 
-a, 2 -(a)! 0 
0 —a2 2 — (аз)! 
eui 2 -(aj)! 
-а— 2 -(a.)) ! 0 
—@—1 2, — (a)! 
0 0 7А 1 
1 
ai 
ana, 
x j—]8j—2:::d20] 
ар 2ар-3 d201 
аг 181-2 ``‘ а2а] 
агар-1 9а 
1— (а) 1а] 0 
—a, + 2а — (ал) азал 0 
= —àj-14j-2:::a21 -2aj 1j 27:201 — (aj) аја: а _ |0 


—arap-|i:::d20] + ALAL-1 +: аа 0 
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Solution 8.104 To prove (8.96), we note that 
(D? = (EDE 
ZO = MEO) 
(2.5) 
= (Ur: Urini lUr: Uni) = (ni [UT «+ UU; Ui Pini) 
(8.93) (2.30) 
= Ma Pai) = al] =1. 
(2.37) (2.5) 
To show (8.97), we have 
\{Г(@)|Г(т)) = (=()®х(1)| (m) хт) 
(8.94) 
=, (#()\#(т))җ((т)) = (18 (2) = (200100) аһ 
(3.4) (8.91) 
Sy [Ж Q)1l бт == бп 
(2.5) (8.96) 
Solution 8.105 Starting with (8.115), we have 
(a0) (b0| & 182—2) |х(т)) = |а) (blx(m)-1) ® |0) (0|х(т)г. 2) & |х(т)г.—з...х(т)о) 
= Ôb (m), i Óp (n), 2 laO0x(m)r-3 m .x(m)o) . (G. 173) 


Recalling (8.90), we obtain 
x(m)2—-0 © m«2. 


So only m = 0 or m = 1 give non-zero values for the right side of (G.173). From 
(8.92) we also know that 


|х(0)) =|0...0) and |x(1)) =|10...0). 


We can thus re-write (G.173) as 


724 Solutions to Exercises 


(140) (b0| & 19-7?) |x(m)) = Ôb кт), ., (5m,0 + 8,1) |a0. . .0) 
= (5, (0), 1 бл, + Ôb (1), 951) |а0 m .0) 
== (5b,06m,0 T ӧд) lao e .0) 
= (бьобу,о + 55,1m,1) (40|x(0)) + 52,1 |х(1))) 
= 65,065,050 |x(0)) + ӧрт», да,о|х(0)) 
+ 6p,06m,05a,1|¥(1)) + 05,165,104,1|x(1)) 
= 6p,005, 004,0 |x(m)) + 85,18 m,1 Ôa olx(m— 1)) 
+ 5,065,004, |x(m + 1)) + 65,1 6,1 52,1 |x(m)) , 


which is (8.115). For (8.116) we have 


(18-2 @ |1a0) (15018-1) |x(m)) (G.174) 


= бу (т), 141 рх(т) иот) 1 CM) L-1 - --X() riso LaOx(m) 1-1-2 ...x(m)o) - 
Using again (8.90), we find 
x(m).;121 € т>1—1 and x(m)p,.120 © т<1+1. 


Hence, for the right side of (G.174) not to vanish, we must have/ — 1 < т < 1— 1, 
that is, m = | — 1 or m = Г only. Recalling again (8.92), we know that 


71) =| Lied 0...0) and |20) — L1... 10...0). 


1—1 times 1 times 


We can thus re-write (G.174) as 


(197? & |1а0)(1Ь0[1®Ё——1) [x(m)) 
= бууну (баа Óni)] 1... 1 a0...0) 


1—1 times 
„=, (85,005, 1-1 + 05,105,4)] 1...1 a0...0) 
(8.90) 1—1 times 
= (05,005.11 E ӧл) (б, о|х(1 um 1) F Ôa,1 |х(1))) 


= баобь,о9дт—1|Х(т))) + ба, Ôb,1 Ôm 1|x(m)}) 
+ 65,105,064, 1 1|x(m 4- 1)) + 65,005105,|x(m — 1)), 


which proves (8.116). For (8.117) consider 
(197 & |1a) (1b]) x(m)) = i qu), Sb qu) (7) 2-1 -- -x(m)21a). 


Once more, (8.90) implies 
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х(т) = 1 е m=L—1 or т=1. 
Proceeding as before, this yields 


(12272 ® 1а) (15) |х(т)) = Ôb x(m)o (82-1 + nL) |x(m)z-1 ..-x(m)21a) 
ху (об T Óp1 $1) | T: 11a) 
(8.90) 


(ôm L- 1 ьо T Ьл) (до А m 1) + 64,1 |x(L))) 
= (52,05,05n,t—1 + бал ôn 1 бл.) |x(m)) 
+ 64,05p,1 On, |x(m — 1) + 65,165,905 1 .1|x(m + 1)) , 


which completes the proof of (8.117). 


Solution 8.106 Making use of the result (2.48) and the fact that both Hr(s) and 
Руль are self-adjoint, we see that the claim (8.129) is proven, if we can show 
that their product Ну (5)Р, ць is self-adjoint. From (8.122) it is evident that this is 
the case if HiniPsub and Hg, Pup are self-adjoint. From (8.99) and (8.100) it fol- 
lows that the latter is true if in turn each Hx Pup is self-adjoint for the various 
X € {c-ini, input, clock, /}. We now proceed to show this. First, we consider 


L 
He-iniPsub 2 He-ini > [D (m (Г (т)| = у Не-и Г (m)) (T (т) | 
pees meu 
L L 
x 2, (1 ёо) Com) (m ОЮ 


zx Psw — |T (0)) (7(0)] , 


where (2.36) assures us that the last expression is self-adjoint, implying that this is 
also the case for He iniPoub- Similarly, we have 


L 
HinputPsub — 2, Hinput |I (m DT (m)]. = ‚0 
(8.1 т=0 (8.119) 
HelockPsub =, У, Haoek| Г (m)) (Г(т) | = ‚0, 
(8.129) "= (8.120) 


and since the zero operator is obviously self-adjoint, so are HinputPsub and HelockPsub- 
Lastly, for / € {1,...,L} consider 
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H;Psub ert У Hir (m))(r (m)| 
1, 
У (91-1 + Ôn) |T (m)) (Г (т) | 


-E X, (а Гн DXT (н) nalOn- 1) Гн) 


m=0 
1 
= z TE- DEE- 1) +r OTO] 
- ID D pP DX 
which is self-adjoint due to (2.36). Consequently, HpropPsub = КУ, H, Pup is self- 


adjoint and thus ultimately Нт(з)Рь as well. As already mentioned above, the 
claim (8.130) then follows from (2.48). 


Solution 8.107 Let " 
| = У Ч„|Г(т)) 


m=0 


be an arbitrary vector of Hsu». Then we have 


L UD 1 L 
(|Н го] Y) = 4 En = (Г (k)| HD (m)) 
ОА 
(8.104) 
cd X Xen.) (ron) 
= a kim ml-1 ml I (K)|I (m 
2 поі 
(8.121) 
— ôm 1 10 (AE (m+ 1)) — 6,40 (X)| E (m — 1))) 
Leh ano. 
= A. PPn (05,11 + Ont) Okm — Ôm 1—1 km 1 — O5 Ôkm-1 
‚25% ( i 
(8.97) 
1 LL 2 __ 
= 5 Y, У (ЧЕ (8C a + бы) — WE 190 РЫ) 
к=01=1 
1 L 
= 5 2, (1-1-1 +30 — 01—010) 
1=1 
LS y-o (G.175) 
= 5 i= H 2 0. . 


For an arbitrary |Ø) € HY & HC we have Рь|Ф) € Hsub and thus 
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(Ф| Нргор lu. ©) (D| Prub HpropPsub® ) = (Psub® |HpropPsub P) 


(8.131) (2.30) P* , — P. 


(G.175) 


and Definition 2.12 implies (8.132). 


Solution 8.108 To prove the claim, it is helpful to use the abbreviating notations 
b = b(s,E(s)) and Ө; = @;(s,E(s)) and to introduce the following variables for 


jE {1,2} 


uj = m6; (G.176) 
vj — (n—2)0j, | 
which satisfy 
ЕЕ (m — 1)0; 
2 (G.177) 
Mj—Vi g, 
2 E 


We then have 


+ B;[bSi; ((m— 1)0;) — Si; ((m—2)0)] 
-— Aj [2Co;(0;) Co; ((m— 1)6;) — Co; ((m—2)6j)] 
+В; [2Со;(0;) Si; ((m— 1)0;) — Si; ((m— 2)0;)| 


i A aco, ( z 1) co; (222) -Co;(vj)] 


(G.177) 
+00, ( E DJs © 1) -si (v). 


Here we can use the trigonometric identities 


(G.178) 


which hold for j = 1 and j = 2. Hence, we obtain 
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b®(s)m—1 — O(s)n-2 =  AjCo;(uj) + B;Sij(u;) 


AE Aj Coj(m0;) +B; Sij(m0;) 


which proves the claim. 


Solution 8.109 We will first show that the solution (8.148) of the recursion together 
with the boundary conditions (8.142) and (8.144) leads to (8.150), where Ta; is as 
defined in (8.149). 

We use again the abbreviating notation 0; — 0; (5, Е (s)). The boundary condition 
(8.142) requires 


which implies 


A 1;(0; 
"o єз» 
Whereas (8.144) requires 
Ф(5) = сФ(5)г—1› 
which implies 
A; cSi;((L- 1)6;) - Sij(L0j) (G.180) 


Bj 7 Co;(L0;) — Со; ((L— 1)6;) ` 
Hence, we must have 


Sij(07) = cSij ((L— 1)0;) — Si;(L0;) 
a — Coj(6) Coj(L6;) — Co; ((L— 1)67) ' 


Z 
(G.179),(G.180) 
which leads to 


Si;(0;) Coj(L0;) — Si;(L0;) Coj(6;) = acSi; ((L— 1)0;) — aSi;(L6;) 


On the left side and in the last term on the right side we use the identity 


51/(и) Co;(v) — Co;(u) Si;(v) = 51/(и — v), (G.181) 
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which holds for j — 1 and j — 2, to obtain 
(1 +ac) Sij ((L— 1)0;) = aSi;(L0;) = CSij ((L— 2)0;) А (6.182) 


Here we can use the second of the identities (6.178) with и = L0; and v = —(L— 
2)0;, which yields 


51/010) =, 2Coj())Si; ((L— 1)6;) — Si; ((L—2)8)) 
(G.178) 
= PSij ((L— 1)6;) - Si; ((L—2)8)). 
(8.147) 


Inserting this into (G.182) gives 
(1 -Fac — ab) Sij ((L— 1)0;) = (c— a) Sij ((L— 2)0;) 7 
Using the identity (G.181) with и = (L— 1)0; and v = 0;, we find 


Sij ((L—2)0j) ee, Sij ((L— 1)0;) Co ;(0;) = Со; ((L— 1)0;) 51/(0;) 
(6.181) 


= Si; ((L-1)0;) : — Co; ((L— 1)6) Si;(67). 
(8.147) 


Inserting this into (G.182) yields, after some re-arrangements, 


Ta; ((L— 1)0;) = LU a z (G.183) 


In deriving (G.183) we have ignored the fact that Co; ((L—1)@;) as well as b(c + 
a) — 2ac — 2 can be zero. We will continue to do so, but shall discuss the points 
(s,E) where this happens in more detail in the proof of Theorem 8.26. 

Now, (8.147) also implies 


(Өй. = sinh 0; forj—-l | cosh? 0; — 1 for j=1 
vee кеа sin 0; foj-2 1—cos?6, for j=2 
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which, inserted into (G.183), yields (8.149). We have thus shown that a solution 
of (8.142)-(8.144) implies (8.150). From Lemma 8.25 we know that a solution of 
(8.142)-(8.144) is equivalent to |Ф(5)) being an eigenvector with eigenvalue E(s). 
Consequently, E(s) has to be a solution of (8.150). 


Solution 8.110 The proof of the claim (8.152) is accomplished by making use of 
(8.145) and (8.151) and straightforward, albeit lengthy, calculations, which we give 
here without many of the intermediate steps. Again, we ignore here the fact that 
b(c + a) — 2ac — 2 can be zero. We will continue to do so when proving (8.152), 
but shall discuss the points (s, E) where this happens in more detail in the proof of 
Theorem 8.26. To begin with, we have from (8.145) 


n _ AE(E — 1) +25 
тес рову. 


Here and in what follows we use the abbreviation E = E(s). We then have 


4s(1— E) - 8E(E — 1)? 


b(a+c) = 


s2(2 — 2E — s) 
as well as 
253 — AES? 
2ac = =~ 
s2(2—2E—s) 
in 2s(s— 1) AE(1 — E) 
sis — I)-F = 
= : G.184 
TUS s(2—2E — s) ( ) 
Hence, we find 
2(2Е – 1 1-Е) -2E(E — 1)? 
b(a+c) – 2ac 2-454 MESE ec cae (G.185) 


On the other hand, (8.151) gives 


2(s- — E)(E — p,)(E — p.) =s?(2E—1)+s(1—E)—2E(E-1)? 


as well as 


(E —z+)(E —z-) = i (2s(s 1) -4E(1— E)) 
such that (G.185) becomes 


8(s_ — E(E — p+)(E — p-) 
s2(2 —2E — s) | 


b(a+c)—2ac—2 = (G.186) 
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whereas (G.184) becomes 


aa THERE) 


s(2—2E — s) (9187 


Using (G.186) and (G.187) yields 


(с—а)у/(—1)/@-Ь) _ (E-£)(E—2) sV(CI/4—9) в, 


b(a+c) – 2ас– 2 (E—pi)\(E-p_) 2(Е—5_) 


Here we can use that 


— Е\? —1\/ 
ли) = cay (4-4) — D 8-19) 


(8.145) 
- ЖЕШ. (ы-у ыи - 0) 
zo E s Bg s), 


(8.151) 


where 5; — E > 0 in both cases and s. — E > 0 in Case j= 1 and s- — E < 0 in 
Case j — 2. Consequently, we have 


sy (—1) (4-b) _ (-1)(E —5-) 
к-к) COMME тыу cs 
where 
(-19(E-5-) [im ifj-1 [-yge—m ifi-1 
(E— s.) Wu ifj=2 ly  idfj-2 
(-1) 
_ М(—1(Е-5-)' 
such that 
sy(-1)(4—P) _ D ўр – ЕЁ 
кеу е) 
Inserting this into (G.188), we obtain 
(c-a) (-1y(4- P^) j (E-z)(E-z-) 5+—Е | 
bato) 2a -2 a ean) IDE E у YOE) 
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proving the claim (8.152). 


Solution 8.111 The statements for s — 0 and s — 1 are easily obtained by inserting 
these values in (8.151). 
For s €]0, 1| we first obtain 


— 
=> 
=> 
< 


(1+s)? > 1+? > (1-5)24-52 = 1—25 252 


1+5 > уж 52 > V1 — 254252 


2+2s>1+s+vV1+4+s? > 1+\У/1—25+ 252 (G.189) 


l+s>5(1+s+V1+s?) > 1(14V1-2s42s) 


$4 > рь > £4. 


Similarly, we have 


and 
=> 
= 
=> 
=> 


< 


ууу 


1»5 
2s > 252 

1—2s+2s* > 1—45+ 4s? = (1—2)? 

V1—2s+2s? > 1—2s > —vy1— 254252 
14+ V1—2s+2s? > 2(1— s) > 1-у1- 254+ 252 
(14+ V1—2s+ 2s?) > 1—5 > i(1- V1 —2s + 2s?) 

Sis xus > Z 

V14+s?>1 


—2s > —2sV 1 +s? 


1—2s+2s* > 14-252 —2sV1+83 = (s—V14+s2) 

V1—2s+2s2 > s—V1+s? > —V1— 254+ 2s? 
1+ V1—2s+2s? > 2(1— 5) > 1-у1- 25+ 252 
=> 1(1+У1-25+252) > 5(1+5— 1+2) > 2(1-У1-25+252) 


1+ > р- БЕ 
(С.190) 


Together (G.189)-(G.190) imply for O < s < 1 thatz. < p_,s_ < Z+ < py < S+. 
For 0 < s < 3 we find 


i >s 
=> 6s > 852 
=> 1+% > 9s?-—6s+1 = (1—3s)? 
=> 1-3s>-V1+s2 
>2-2s>14+s—V1+4+s? 
> 1l-s>4(l+s—V1+s) 


= s_ > р_ 
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and conversely for i <s< 1 that p- € s.. Altogether thus for 0 < s < 1 


3 
Z < p- <8 < Z+ < P+ < S4 ifs< 7 
f 3 
z- <s- p-<z <p} < + Из > 
as claimed in (8.154). 
Solution 8.112 Let s €]0, 1]. Then we have 
ssi 
e 0s 3—4s 
e 1+8? S 5 —4s--4- (2—5)? 
e М1+52&2—у 
e 1+8? S (2—5)//1+52 
e 1- (2-5 1-5 < —s* 
e (2—s)(1--s— V14- $2) < 1+s—2s* 
92 A 
ep- = 3 (I+s-viFe) $ БОЕ) ZÉ 
(8.151) (8.157) 
and similarly 
:si-1 
1-7 
p p 2 49 
1 7 _ 7 2 
= a 5 (3-5) = 6 —45+5 
e 05 3—7s+4s" 
e 1+s—2s? S 4—6s-- 232 —2(2— s)(1— s) 
A _ 15—252 = 
ә Е = 20-5) Sl-s = s- 
(8.157) (8.151) 


Lastly, 
3 1 4/3 3 
ЭЁ, — =-=f — == - — 
E 


is easily verified from the definitions (8.151) and (8.157) of s_,E and p_. 


Solution 8.113 Let p. (s) € I, (s) and p_(s) Z Es q_—2. Then we have E;4 2 < 
p — (s). It follows from (8.161) and (8.151) that then 


734 Solutions to Exercises 


1—scosQ 2 < s(lte-v 1+5?) <1, 


which implies cos ot 2 > 0. Thus 


from which we obtain g_ < L 4 1. 
Next, let рі (s) Є I4, (s). Then we must have р. (s) < Es, —1. It follows again 
from (8.161) and (8.151) that then 


1< (1+8 V1+s?) <1—scosaq,-1, 


which implies cos 0, —1 < 0. Thus 


Solution 8.114 For p. (s) € I;(s) to be the case, (8.163) requires 5 < q < 5 +1. If 
L = 2k, this would imply k < q < k+ 1, which has no solution for q € No. Hence, 
+(s) € I4(s) is only possible for L = 2k+ 1 in which case q = k + 1. Moreover, 
p(s) € 1,(5) also implies that p+ and p_ cannot be further apart than the width of 
the interval, that is, we must have p. (5) — p (s) < Es -1 — Es,q—2. It then follows 
from (8.161) and (8.151) that 


"S 


V 1s? < 5(с05 042 — cos 0.1). (G.191) 


Using that L = 2k+ 1,q = k+ 1 and (8.160), we find 


"n 2(q—2)+1 (i 1) 


2(L — 1) 2 4k 
. 2g — 1) +1 _ [1 | 1 
WD SE- 7 A3 744) 
such that 0,1 + 04-2 = л and thus cosa; = —cosot 5. This together with 


(G.191) and s €]0, 1] implies 


1 < V1- s? < 2scosOg_2 < 2c050 5. 


Hence, for рі (s) € (5) to be true, we must have cos Qt, » > 5 and thus 
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О, = : : met 
42 12 4k 3^ 


which requires k « 3, that is, L = 2k+ 1 « 4. Since we know already that L has 
to be odd, and we assume L > 1, the only remaining possibility for p(s) € J,(s) 
to hold would be the case k = 1 and thus L = 3 and q = k+ 1 = 2. Consequently, 
0,2 = O = f and cosa, 2 = A and the only remaining possibility is 


рь єз) = ll- ben]. 


(8.162) 


It follows from the definition (8.151) of the p+ that in this case 


S 


saV 


The first of these inequalities implies 
М1+52 <(М2+1)5—1 


> 1+5%  <(2+1+2V2)? +1-—2s(v2+1) 
=> 1 «s, 


3 


which is outside the range to which we have restricted s. Consequently, it is impos- 
sible to have p(s) € (5) for any L > 1. 


Solution 8.115 To begin with, we have 


A(t) - H(]| = ПА -Ho |] 
(8.210) 
K(t Kit t-t t—tr, 
zc) s (i-es 
(8.206),(8.208) 
K(f) t—tfini K(f) t—fini 

== ( 2 is) H : ( 2 2) Hini 

K(t t — fini 
e 0) p IPs — Has - (G.192) 
(2.7) 
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Using that T — JAt, we obtain 


k(t) t— fni _ k(t) t — fini _ 1 (o м) 


(С.193) 


so that 


кї) | t— fini 
J T 


[Hán Hinil| 


1 
< 7 Pas — Hail - 
(G.193) 
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Solution B.116 


(i) We show €; € {0,—1} by induction in j. The induction-start at j = 0 is given 
by the starting assumption бу = 0. 
For the inductive step from j to j+ 1 we suppose that ё; € (0, —1) holds true 
for j. Then the possible values for ён as а function of ће possible values of 


the aj, b; and 6; are as shown in Table G.1 and ёт € (0, —1] is satisfied. 


(ii) To prove (B.8), note that the assumptions 0 < a,b < 2" and d; € (0,1) as well 
as (B.5) imply 
п—1 
-2'«b-a- У 42) +72" <2". (6.194) 
j=0 
KH’ 
>0 


Hence, in the case b > a it follows that €, has to take the value 0 and in the 
case b < a it has to take the value — 1. Conversely, it follows from (G.194) that 
6€, = 0 implies b > a and that бу = —1 implies b < a. 
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Table G.1 Table of values for €; as function of aj, b; and 6; 


aj bj €; ёмы = Ещ 
0 0 0 
0 0 —1 
0 1 0 
0 1 0 
1 0 —1 
1 0 —1 
1 1 0 0 
1 1 —1 —1 


Solutions to Exercises from Appendix C 


Solution C.117 The assumption f;(N) € O(gi(N)) for i € {1,2} means that there 
exist C; € Капа M; € N such that 


VN >м; |fiN)| € Cilgi(N)| Ме оо. 


For M := max(Mi, M») we then have for all N > M: 
(i) 


LA (QN) + f2(N)| < |A(N)|+1AW)| 
€ Ci |g1(N)| + C» |g2QN)] 
< max{C1, C2} (|gi(N)| + |g2()|) 


S and thus fi (N) + (М) € O(|(N)] + |g(N)]). 
LA(QT) (А) < Aa (^/)|| 5 QN)] 


€ Cı |в1(\/)|С› |\в2(Ї/)| 
= CiC2|g1(N)g2(N)| 


and thus fi(N)f2(N) € O(g1(N)g2(N)). 
Gii) For N > M we have, by assumption, |gi(N)| < |g2(N)|, which implies 


LA (М) + (А) < LA (А) + LQN) | 
€ Ci |g1(N)| + C» |g2QN)] 
€ (Сі +С) |g2(N)| , 
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such that fı (N) + (№) € O(ga(N)). 


Solutions to Exercises from Appendix D 


Solution D.118 To show =, note that 
amodN —bmodN => a—|=|N=b- HE 
(D.1) 


and it follows that N divides a — b, which implies (a — b) mod N = 0. 
To show <=, let (a — b) mod N = 0. Then it follows from (D.1) that there exists а 
z € Z such that a — b — zN. Consequently, 


bmodN = »- | |a zN | Ina Е 
М N 
(D1) (D.1) 


Solution D.119 Let a, N € N with a > М. For any x € К we have 
0x x-|x| «1 


such that N — FI < 1 and thus 


amodN = a— ЕСЕ 
се N 
(D.1) 


On the other hand, one can easily convince oneself with a graph of the functions that 
x > 1 implies 5x < |x]. Because a > N this in turn implies 54 < | | from which 
it follows that $ < | | N and thus 


amodN — a— НЕЕ 
М N 
(D.1) 


a 
2 . 


Solution D.120 Let u,v,u; € Z and К,а, № € N. We first show (D.20). 
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u(v mod N) 
u(vmod N) mod N E u(v mod N) — е N 
Ta ке 
= walg] E-z] 
= иуи М | |м+и | N 
= w- [E]n 
uvmod N. 


<> 
(D.1) 


Repeated application of (D.20) then yields (D.21): 


k k-1 
(m uj jm) modN = =. (Tk uj mod N)u м) mod N 


(D. en Jl 


- (а) sm 


j=! 


With и; = u, then (0.22) follows as a special case of (D.21). To prove (D.23), it 
suffices to show this for и and из. The claim then follows from repeated application 
of the statement for и and u2. For the left side one has for иј and из by definition 


(m mod N + u2 mod N) mod N = (u — Е М№+иә = ka N) mod N 


N 
= и| [|+ ш 
= yte I y 
N 
una (ум [dv 


[5x - E] G 
=m +m-||n-|2]y 


е аер 
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uy +u2 
n 
= (u +u) mod N. 


Solutions to Exercises from Appendix F 


Solution F.121 Suppose first that besides e there is an € € О such that for every 


g € 9 we also have 


ge—g 
eg |—6 
This implies 
gx = g)! > gg =g =e 
Кр 
(G.195) (ЕЗ) 
е ге e, 


ар Кар 
(G.196) (9.195) 


showing that e is unique. 
Now, suppose that hı and hz are two inverses of g c 9, that is, 


gh =e = gh». 
Then it follows for i € {1,2} that 


-1 -1 
в = ge = ghih; ,-— eh; 


(E2) (ЕЗ) (С.197) 
and thus 
hig = hjeh;! = hih! = e. 
“MY “MY “MY 
(G.198) (Е2) (ЕЗ) 


Consequently, we also have 
hig — e-— hog, 


(G.195) 
(G.196) 


(G.197) 


(G.198) 


(G.199) 
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which finally implies 
hi = he = hgg! = hgg! = һе = h. 
1 1ё 188, 288 2€ 2 
(F2) (F3) (G.199) (ЕЗ) (Е2) 


Solution F.122 From (F.2) we have for g = e that ее = e and from (Е.3) we see that 
then e = e^, proving (F.A). 
Next, consider 


h(h 5g | = ghh 5g! = si =j 
gh(h g )-—ghh в geg 88 е, 
(ЕЗ) (Е2) (ЕЗ) 


which proves (Е.5). To show (F.6) note that (F.3) implies e = g^! (gr Multi- 
plying both sides with g and using that, because of (F.2), we have on the left side 
ge = g, we obtain 


h=g > hg = gg 3e 
(ЕЗ) 
h!=g! 2 
= g (G.200) 
(E3) 
—-]Vcl -1\7l _ 
cy He) >, де 
(G.200) (F.6) 
proving (ЕЛ). 
Solution F.123 To prove (F.8), we note that 
-1,)71 -1/,-1)71 -1 
= = .201 
(8\8) & (8) 8 8 (G.201) 
(Е.5) (R6) 


which implies 


proving (Е.8). To show (F.9), we note that 
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_ү КТЕ 2p acl _1ү—1 
e (0071) sete) ae) Se) үл. 
(ЕЛ) (Е.5) (Е4) (Е2) (ЕЛ) 


To show (F.10), let gh = gk for some g,h,k € S. Multiplying both sides from the 
left by g^! and using (F.8) implies Л = k. Multiplying this in turn by g from the left 
yields gh = gk. Hence, gh = gk if and only if Л = К. The proof of the equivalence of 
hg = kg with h = k is similar. 


Solution F.124 Any subgroup contains the neutral element ес, which is then also 
contained in Hp. 
Let 81,82 € Hn. Then 21,22 € Hj for every j € J. Since each Hj is a subgroup, 
we thus have that also 2182 € H; for every j Є I, and it follows that #182 € Hp. 
Likewise, if g € Hp, then g € H; and thus g~! € H; foreach j € I, which implies 
that g^! € Hn and completes the proof that Hp is a subgroup. 


Solution F.125 Since egg = geg for all g € 9, it follows that eg € Clzg(S). 
Let hy, h2 € Clzg(S). Then we have for every g € S 


(hiho)g = hi (hog) = high = т 
(ЕЛ7) (ЕЛ7) 


and thus hyhz € Clzg(S). 
Finally, for any h € Clzg(S) and g € S 


hg, — gh > gh! = 16 = h ! € Clza(S). 


(E17) (Е.17) 


Solution F.126 Let g be any element of the group б. Since e c Ж, it follows from 
(F.19) that e € HE as well and (F.14) is satisfied for HE. 

Now let A! € H8, that is, there exists an h € H such that  — ghg—!. But we also 
have from (F.19) that gh^! g^! € H8. Hence, 


hl (gh 187!) = ghg gh g^ —e 
and thus (A)! = gh^! g^! € Н, which shows that (F.15) is satisfied for H8. 


Finally, let ^, € H8, which, due to (F.19), means that there exist hı, h2 € H 
such that h’, = ghjg-! for j € (1,2). Since hıh € H, it follows that 


hih, = (ghig ') (ghoag ') = тв є HE, 


which shows that (F.16) is also satisfied for 18. 
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Solution F.127 The neutral element e of S clearly satisfies $^ — ебет! = S. Conse- 
quently, e € Norg (S), and (F.14) is satisfied. 
For any /1,h2 € Norg(S) we have 


hi ho —1 —1,-1 Лә „—1 —1 Л 
shila = hhS(hh;) | = аон! = hy Shp! = А! = S^ 
(F.18) (Е.18) (F.20) (F.18) 


= 6 
м 
(F.20) 


such that hhz € Norg (S), verifying (F.16). 
Finally, for any ^ € Norg(S) we have 


hSh | = s* = § 
М2 мн 
(Е.18) (Е20) 
—1 
> S-his(hl)!- 5° 
куры 
(Е.18) 


such that A7! € Norg (S), and (F.15) is satisfied as well. 


Solution F.128 The neutral element e of б clearly satisfies eg = ge and so e € 
Ctr(9), verifying (F.14). 
For any /1,/2 € Ctr(9) we have 


hiig = high; = ghih 
(Е21) (Е21) 


and thus луй € Ctr(9), showing that (F.16) holds. 

Moreover, for any h € Ctr(9) and g € 8 we have hg = gh which implies ой! = 
h^! g and thus ^^! € Ctr(9) as well, verifying (F.15). 

Finally, we find for апу g € 9 that 


Cu(9)5, = {аһа |^e Cu(S)), = (hgg ' | h € Ctr(S)} = Ctr(S), 
(F.18) (E21) 


proving that Ctr(9) is normal. 
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Solution F.129 Definition F.15 of a normal subgroup H implies 


ÉH is normal 
& VgeG WheH heH and Vh c 9€ 
VgeS WheH She and Vh e 9€ 
€, VgcS gH= Hg. 
(F.22),(F.23) 


he: ghg! =h 
heK: gh = hg 


Solution F.130 Associativity of the product follows from the associativity of of the 
products in each group. The neutral element is given by 


€g,x9; Т= (69169) (G.202) 
since for any (21,22) € 91 x 92 


(21,82) x (691,9), = (81e9,,8269;) = (81,82). 
(ЕЗ7) 


Similarly, any (21,2) € 91 x 92 has the inverse 
(g1,82) = ($15.82) 


since 


—1 —1 —1 
(81,82)°х (81,82) = „(818ү .828› ) = (есү,ес„) =, е81х9. 
(ЕЗ7) (G.202) 


If 9; and 9 are both finite with their number of elements |91| and |92], then the set 
9, x 92 is finite as well and has the number of elements |91 |192]. 


Solution F.131 By the defining property (E.40) of a stabilizer, we have for every 
m € M that e.m = m, which implies that e € Stag (Q) and thus verifies (F.14). 
Let h,g € Stag(Q) and m € M be arbitrary. Then we have 


(hg).m, = h.(g.m), = h.m, = т 
(Е41) (R42) — (R42) 


such that hg € Stag (О), which proves (F.16). Finally, we find 
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= Z =1 =. gal — s 
m, = ет = (g g)m = g (em) = g т, 


(F.40) (ЕВ) (Е41) (Е42) 


and thus 27! € Stag(Q), which shows (F.15) and completes the proof that Stas (G) 
is a subgroup of б. 


Solution F.132 For any g € бу we have 


ee 
(F.44) (E47) 
and thus q(g^!) = ф(в)—!. 
Solution Е.133 For i € (1,2) let y; € бу and define 
(71,2): 91x 82 — U1) (G.203) 


(21,82) > 41(81)X2(g2) , 


which is a homomorphism, since for any g;, g; € 9; 


Qa. 22) (81,82) x (81,85)) (Q2) 81.8285) =, X1(8181)X2(8289) 


(F.39) (G.203) 
iG 1 (81) x2 (22) x2 (82) 


Qa) (i 22) 002) (81,85). 


Hence, (X532) € $i xS x 92, and since we know from Th Theorem F.34 that ar t» and 
9х9 х Go are groups and from Exercise F.130 that 9х9 х 92 is a group, thus 


Gi х 0 < Gi X S2. (G.204) 


Moreover, we have 


[St x $31, = ilS — 1911921, — 191 x Sal, — 181 x 91, 


(F38) (F.70) (F38) (F.70) 


which, together with (G.204), implies 


$1 x $2 = $1 x So. 
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Solution F.134 Let y € G, and set 


Then for any h € Ж 


Syx(h) = Y, xA = Y, x(hh) = 5, (G.205) 


where in the penultimate equation we have used that y € Hom(9,U(1)) and thus 
satisfies (F.43). It follows from (G.205) that for every y € S and hc 


S, (x(h) – 1) 20. (G.206) 


Now, let y Є H+. Then (F.72) implies that H C Ker(%), and it follows that y (Л) = 1 
for all h € H. This implies $, = |H]. 

On the other hand, if there exists an h € H such that xh) Æ 1, then this is equiv- 
alent to H ¢ Ker( y) and this in turn to y ¢ H+. Moreover, (G.206) implies that in 
this case we must have Sy = 0. 


Solution Е.135 By assumption, H is a subgroup of 9 and from Гетта F.30 we 
know that the kernel of a homomorphism is a subgroup. Since each character is by 
definition a homomorphism, its kernel is also a subgroup and from Exercise F. 124 
we know that any intersection of a set of subgroups is again a subgroup. Conse- 
quently, Mpeg Ker(x) is a subgroup of S. 

Now, let h € H. Then by definition (F.72) of H+ we have for any y € H+ that 
H C Ker(xy). Hence, 


HC a Ker( y) 
хєні 


and each of them being a subgroup, the claim (Е.77) is proven. 
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Solution F.136 We have 


А em А 
$5 E У, x) (0 el) STR > x(8) (15) (8]) 
(Е.107) 869 (2.32) seg 
HES xeS 
1 — 1 _ 
et Vial Y. х(8)18) Wl. ig УХ !(e)lg) (x! (G.207) 
(2.36) seg (F.62) seg 
HES xeS 
such that 
ЕЕ = — У aleda (elx) (81182) Gol 
“WY К 
(F.107),(G.207) E | 81,8269 — 
MEG 8182 
(F.106) 
1 
= Ir У |È xl) х1) 0] 
Xwoc8 \8ES 
Se ХЕИ 
(F.76) Хе 
= 1н, 
“Ww 
(F.106) 


and it follows from (2.37) that Fs is unitary. 


Solution F.137 With the change of variables 


е (6.208) 


У = ГР, 


it follows first from (Е. 109) that r3 = —u and then 


(r1— r2) (n — rs) (r2 — r3) = (n — r2) (ri +u) (ra 4- и) = (rı — 72) i +v) (G.209) 
as well as 


—(w +v) (G.210) 


В = иу. (G.211) 
м 
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Consequently, we have 


= (u? — 4v) (2u? +v)? 


= Диё – 15и2у? —12w^ — 4v? (G.212) 


as well as 
443 = —4(u? +v)? = 4и® + 12i? — 12vut — 4? 
— 
(G.210) 
(G.213) 
-27B = —27и^? 
WY 
(G.211) 
such that 
—Ag =  — (44? + 27В?) 
ме 
(F.108) 
= Диб – 15i? — 12vu4 — 4? 
WY 
(G.213) 
= ‚ ((n-m)n-r)(m-r3)) 
(G.212) 


Solution F.138 Clearly, the matrix product is associative and oo = 1 = ep € Pisa 
neutral element under matrix multiplication. 
For any two elements i^o, , i Op € P, we have for their product 


j^^ gg ifa=0 
iOi og =i ag65. = ‚+ oy if B =0 
(2.76) [1272 (6,600+ієавусу) 110705 В 
ion ifa=0 
-a+b : 
С, #В = 0 
=<) "ea : p (G.214) 
i+ Gp ifa=B +40 


eho, withe=0'orl ifaf~0FB а, 


= id mod4 


and, noting that 14 ‚ we see that 


соор € P= {оу | c, y € {0,...,3}}. 
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It follows from (G.214) that for апу іс; € P 


(iOa) lOa 21370205 = оу = 1, 
proving not only that any element in 7? has an inverse in Ẹ, but that also the inverse 
is given by its adjoint and thus P < U(2). By selecting a basis іп ‘H, we can identify 
every element in the matrix group U(2) bijectively with an element in U(‘H). 
The elements i^o, € P are given by specifying one of the four exponents a € 
{0,...,3} together with one of the four indices 0 € {0,...,3}, giving altogether 16 
distinct elements and proving that |P| = 16. 


Solution F.139 To prove (F.127), we first need to show that any element i^o; € P 
can be written in the form 


. Up Ур W 
i“ Oa = Il оу! Oy’ Oz " 
р>0 


with up, vp,wp € No. First, we show how i^oo for a € {0,...,3} can be written in 
this form: 
Oo = 0? = 00 1бу = 60,0, 
м7 
=io; 


—0) = (0,0,0,)" —ioy = (0,0:0,). 


With this, we can generate i^o; for j € {1,2,3} by multiplying 0; with the powers 
of 0,0;0, given above. For example, 


2 . 2 
i0,— 06:04, —0,— 0;0,(0:0;0у), —iOy = 0;04(0:0.0,), 
which shows that we can generate i^o, for a € {1,2,3} and in the same way this 


can be done for o, and o;. 
To show (F.128), we first note that as a set 


(100) = {+00,+ido}. (G.215) 


Now, let g = ifOg € Ctr(P). This implies gi?og = i? ogg for all b, B € {0,...,3}. 
Hence, Og has to be such that 


бобв = 050a VB € {0,...,3}, 


which can only be satisfied by o = 0. It follows that g = i^oo with a € {0,...,3}, 
which implies g € {+00, ioo). With (G.215), we thus have 


Ctr(P) C. (109) : 
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Since Оо = 1, the converse inclusion is obvious, and (F.128) is proven. 


Solution F.140 With 


g =, 9X, (x(g))Z(z(g)) (G.216) 

(Е.141) 
h =, ®х,(х(л)) E. (z(h)) (G.217) 

(Е.141) 
gh =, ic! Y. (x(gh)) X. (z(gh)) (G.218) 

(Е.141) 

we have 
sh =, POWE (x(g)) Ee (2(g)) Ex (x()) Ex (2(h)) 


(G.216),(G.217) 


jels)+e(H) +2418) y (x(g) È x(h)) Z,(z(8) & z(h)) 


=, iE, (x(gh)) х, (2(gh)) , 
(G.218) 


and since Lemma F.68 tells us that the representation of gh with the help of 
c(gh), x(gh) and z(gh) is unique, the claims (F.143)-(F.145) follow. 


Solution F.141 First, we show that Nory, ($) C Clz», (8). For this let g € Nor, (8). 
By Definition F.16 this implies g8 = Sg, which means that 


VheS3heS$: gh—hg. (G.219) 


From Proposition F.70 we know that for any h,g € P, we have either hg = gh or 
hg — —gh. Hence, (G.219) becomes 


VheS3heS8: hg = hg, 


and we must have either h= h orh=—h. Suppose h = —h. Since 8 isa subgroup and 
h,h € 8, it follows that then hh-! = —1*" € 8, which we have excluded. Therefore, 
we must have h = h, and (G.219) implies 
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751 
gh=hg Vg Є №огр, (8) andhe 8 
and thus 
Norp, (8) C Сіхр, (8). 


(G.220) 
To prove the converse inclusion, let g Є Clz, (8). Then it follows from the definition 
of Clz in (F.17) that 


gh=hg Vhc$ 
and thus gS = 8g, which implies g € Nory, (8). Hence, 


Nor, ($) 2 Clzp, (8), 


and this together with (G.220) completes the proof of the claim. 
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Solution G.142 We have for every j € J and z € Сх o(A) 


(A-3)Y, = | 


d 


Р т “м 
Jer I (2.42) 


APP; Y Р} 
кй Àj—z À 


ja ^i — & 


Y zPj _ À;Pj zPj 
(2.44) Jet Aj—z РЗ hi 2 1-2 1-1 
= УР; = 1. 
jel м 
(2.43) 


In the same way one verifies that Y jez LA — z1) = 1. Consequently, we have 
d < 


Y= 


— (А-1)! = 
fei hj 2 уе рб 


Solution G.143 From (G.1) in Definition G.1 of (ће resolvent we know that 
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R.(Hr(s)) (Hr) -а) =1. (G.221) 
Since we require Hz to satisfy the Adiabatic Assumption (AA), the function s > 


Hr(s) is twice differentiable. Taking the derivative with respect to s on both sides 
of (G.221) implies 


(Sn. (Hr(s))) (Hrs) - 21) = -R. (Hr (s)) Hz (s) 


(G.1) 


from which the claim (G.7) follows. 


Solution G.144 The claim actually follows from the results of Exercise 2.18, but 
we give the proof here once more for UA ;(s). 
Since for all j € J and s € [0,1] we have 


UA, j(s)* Ua, (s) = 1 = Ua, j(s)Ua,j(s)*, (G.222) 


it follows that 


1= Ug, j(0)*Ua_j(0) Sa, (0) А 
(6.21) 


proving that UA ;(0)* satisfies the initial condition in (G.22). Taking the derivative 
with respect to s on both sides in (G.222), we find 


Ua j (5) UA, (s) + Ua, (5)! UA (5) = 0. 


Multiplying both sides with i, with UA ;(s)* from the right, and using again (G.222), 
we obtain 


iU)! = —Ua,j(s)* (iUa jG)) Ua) 
Z —Ua,j(8)* (Ha j(8)Ua (8) ) Ua C) 
(G21) 
=, Vayl) Ha (s), 
(с 222) 
proving (G.22). 


Solution G.145 From (G.24) we see that 
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ЖОР x hes SE, TPPP) pam 
de "eu n zd 
m 
Consequently, we have 
(а-л), нн) = уз Ва (G.223) 
ke o doo 


Now, (2.44) and P7 = P; imply that for all |Ф), |P) € Н one has ((1— Pj) |P;P) = 
0 and thus 


(1— P) : Ho PHH} cH. 


Using this in (G.223), gives 


a-a (a-a о) GE) 


= LO 
1 
= 1— P;) P. (1— P; 
Ju ica a na) 
1 
- > Scd) (Р. — РР, — Р.Р; + Pi PrP) 
kel 4j) ^ 


which proves (G.25). 


The claim (G.26) then follows from (G.25) and (2.44), whereas (G.27) follows 
immediately from (G.26). 


Solution G.146 We have 


754 Solutions to Exercises 


(НРА +AP;Hr)Šj + (Hr RA + AHr) Pj) 
| a ud oe 2 
К, > ||((HrP;A+AP;Hr Řj+ (HrRjA+ARjHr)P)) || 
(2.51) 
< кР (||(HrP A +APHr i| + ||(FirijA+ARjHr) Pj) 
ч J J J J J J J 
(2.18) 
| : А МР 15 2 
< lš * (|[(HrP;A +AP;Hr) ||| Р || + ||(HrŘ;A +4Ř;Hr)|| 11e) 
(2.51) 
' "ne 3 x 
СА (2 ШШЕ И + ЕЛ D^ 
(2.51),(2.53) 
< (2н иии). (poa eel АРА)? 
«е J J d J J 
||P; ||=1«G.27) 
| . 2 
z. (2|]Hz || uam 1&1). (1a — e| + epe? - (G.224) 
(2.53) 
Here we can further use the estimate 
(Па =) ЦР)? = a-ere +a- Ave 
< | |+2||(1—РУ)||\||Р;|\|[Ф]|? 
.£ "+24 21/2 
(2.15) =1 =1 
ЗПП, 


which, inserted into (6.224), yields the claim (G.41). 
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